8 ms·
There’s more than one way to write an IP address (2019)
- bombcar 4y agoAren't there some other ones? IIRC the standard "IP address handler library" would do things like "try any possible way of interpreting it" and would work on words, etc.
- rasengan 4y agoYou could represent each octet as an ASCII char reducing it to 4 characters.
- ryan-c 4y agoOr 5 base85 digits if you wanted to ensure there were no control characters...
- dragonwriter 4y ago> You could represent each octet as an ASCII char reducing it to 4 characters. Except ASCII is 7-bit, and a number of those are control characters. So you couldn’t, and many that you could would be unreadable. <DEL><NUL><NUL><SOH> for localhost is... not ideal.
- lucb1e 4y agoThat sounds like good laptop sticker material. Could even give readers a hint by using the "there's no place like" saying that I've seen applied to 127.0.0.1 and ::1 already, or prefix some hacking tool. I wonder how many people would get it. There's no place like <DEL><NUL><NUL><SOH>
- rep_lodsb 4y agoYou can type control codes (except for NUL, DEL, CR, LF?) on the Linux console by pressing Ctrl+letter. Might add some security to your disk encryption password, unless you need to enter it from a GUI :)
- lucb1e 4y agoHow do you write DEL, which Ctrl+key is that? I had written this actually as ^H^@^@^A, but realized that ^H may remove characters but is not DEL, so I edited that out of my previous comment.
- rep_lodsb 4y agoYes, I don't know if there is any key combination to type DEL. Ctrl just clears bit 6. ^S and ^Q are also problematic because of XON/XOFF. I did use ^G (BEEP!) in a password once. edit ^H is also swallowed by the line editor of course.
- chaorace 4y agoThere are no officially adopted text-representations (for IPv4), only binary ones. In other words: there are simultaneously infinitely more possibilities and exactly zero. For the most part, applications tend to punt the job of interpreting such text address representations to the IP stack (usually embedded in the OS kernel). These vary in what they'll accept by implementation and version, but they tend to be extremely good at interpreting whatever arbitrary nonsense people have historically been likely to try. As a result, there are surprisingly few application-level libraries which even attempt to deal with that mess.
- thequux 4y agoI only know of two operating systems where IP address parsing (and the address resolver in general) is part of the TCP/IP stack: ITS and z/OS. MS-DOS gets an honorable mention due to not having any architectural distinction between parts of the system at all, and z/OS only qualifies because it's not entirely clear where the boundaries of the "TCP/IP stack" are to begin with. (One would be forgiven for thinking that the TCP/IP stack is contained in the address space called "TCPIP". However, significant parts of it are in the LPA, which is part of every address space, and it's not clear to me yet where exactly the resolver is.)
- mdmglr 4y agoIs this an artifact of ping or a standard?
- ryan-c 4y agoinet_aton is cursed: https://linux.die.net/man/3/inet_aton https://linux.die.net/man/3/inet_aton
- LegionMammal978 4y agoinet_aton is its own thing, but at least for URLs in browsers the behavior is standardized (https://url.spec.whatwg.org/#concept-ipv4-parser https://url.spec.whatwg.org/#concept-ipv4-parser).
- rep_lodsb 4y agohttp://032166163360 http://032166163360 => news.ycombinator.com
- tinglymintyfrsh 4y ago~~HN or~~ Firefox rewrote in dotted-quad.
- rep_lodsb 4y agoIf you use "view source", you can see the link isn't rewritten there.
- ackfoobar 4y agoAlthough `href="http://032166163360 http://032166163360"` firefox says the link is `209.216.230.240`. Try also http://0xD1D8E6F0 http://0xD1D8E6F0 and http://3520653040 http://3520653040
- rep_lodsb 4y agoYes, noticed the same thing. It's still one number in the HTML source though, only in the status bar it shows the "normal" IP address.
- billpg 4y ago... but please don't.
- capitainenemo 4y agoObviously the octal and hex and overflow are pretty cursed, but I do like using 10.0.0.* for home IPv4 just 'cause typing ssh 10.1 is so darn convenient.
- theandrewbailey 4y agoI switched to the 10/8 block at home because it's less stupid than typing 192.168.whatever for everything local. I'll have to try this.
- kbenson 4y agoOr set up local DNS and search domains, or even just add entries to your hosts file. `ssh fw` is easy, as is `ssh server`, which while more characters are more in the central typing plane.
- capitainenemo 4y agoI have those too, but I'm familiar with all the IPs and I just got tired of adding DNS entries. Esp for some predictable ones in the "dynamic" range. Also there are times I don't have DNS working. Often times at some console where copy/paste also isn't working or where I don't even have a mouse, and I extra appreciate the simpler typing :)
- ianburrell 4y agoI think the IP address libraries should only accept the standard dotted decimal octet form. And let the others die as non-standard, historical forms.
- lucb1e 4y agoI use this to store IP addresses in a database because you can operate on numbers (e.g. WHERE subnet_start < $thisip < subnet_end) but hardly on the unique dotted format that we normally display them as. Also to specify a bind address when I don't care, like running `php -S 0:3000` (the silly thing wants a bind address rather than only a port number. There, have one!) or accessing localhost in a browser (just typing 0:3000 is enough). For 127.0.0.1, unfortunately the best you can do is writing 127.1. The numeric, hex, and octal variants are 2130706433, 0x7f000001, and 017700000001, which I personally don't find preferable to 127.1.
- lucb1e 4y agoHere's a list of all the ways (and notation combinations) you can make with your IP address: https://lucb1e.com/randomprojects/php/funnip.php https://lucb1e.com/randomprojects/php/funnip.php
- lucb1e 4y ago> Here’s another neat trick. You can overflow a digit. \n\n [...] PING 10.0.513 (10.0.2.1) That's not exactly what's happening. You're omitting the fourth octet so this is then interpreted as a decimal part of the address (you can also have it be interpreted as hex or octal with the usual prefixes). 10.0.0.513 won't work because overflow isn't really what's happening. (For a minute you had me wondering if I missed something in my IP address variants tool because I didn't know that 9.256.0.1 would work as 10.0.0.1, but no, it can't and I've got the other case covered. Whew!) The example can be written more succinctly as 10.513
- electroly 4y agoWhat's happening is more obvious when you consider that you can equivalently write it as simply 167772673. Try `ping 167772673`!
- lucb1e 4y agoNo need to ping if all you want is the conversion :) Just type it into the address bar: https://snipboard.io/kbLTso.jpg https://snipboard.io/kbLTso.jpg (previously posted that screenshot in 2021 https://news.ycombinator.com/item?id=29050936 https://news.ycombinator.com/item?id=29050936)
- sigjuice 4y agoThe address bar is also a bit excessive for doing conversions. $ getent hosts 127.1 127.0.0.1 127.1
- squeaky-clean 4y agoThe first time I ever saw a hexadecimal ip was in a spam text message, one of those "click here for your prize". I laughed to myself thinking whoever wrote their spambot had messed up the url but to my surprise the link worked. I didn't ever receive my prize...
- fsckboy 4y agothe education you received was more valuable than any monetary reward. $2k you earn yourself is worth more than $100k given to you for free.
- anaganisk 4y agoWorth it in an ideal world, in the real world it's a bad advice to compare given vs earned. We wouldn't have the majority of the companies if the founders didn't have the wealth given for them to bootstrap.
- kccqzy 4y agoIt's a common trick to evade spam detection, because the writer of the spam detection software probably didn't think about those weird IP address formats and would fail to extract the URL.
- 1970-01-01 4y agoHah, this reminds me of early firewall bypass techniques. A long time ago, getting to your destination via octal notation was a hack.
- Lightbody 4y agoI "ping 1.1" as my go-to network availability test. It checks to see if Cloudflare is responding, which 99.9% of the time is going to tell you if your internet is working :)
- preseinger 4y agothe behavior you observe is arbitrary
- crazygringo 4y ago> $ ping 10.0.2.010 > PING 10.0.2.010 (10.0.2.8)... It was all fun and games until they started mixing bases, decimal and octal in the same address. That's just cursed.
- salzig 4y agoyep, and I learned to hate IP-Phones this way. Cause some manufacturer (Siemens) wrote (writes?) Decimal IP with 0 Prefix (so it's always three digits) for aesthetics.
- justsomehnguy 4y agoI had a case 15 years ago when .255 were accepted in WebGUI and the stack really tried to get that IP, found out only by running Ethereal on a directly connected patch.
- michaelcampbell 4y agoMakes them sortable via standard text sorting algo's, too.
- rochak 4y agoOh hell no!
- RobotToaster 4y agoI'm disappointed 0b doesn't work.
- lxe 4y agoWhat's the history behind this? I doubt there was legacy or backwards compat reasoning? Allowing for such a loose and wide interpretation makes for complicated parsing and numerous exploits.
- justsomehnguy 4y agoMost of the time it is just a banal shenanigans of strtoint conversions and how exactly the dotted decimal parser was written. > for complicated parsing Somewhat > numerous exploits. Nah. It's mostly localized to a string to hostname processing, ie it never occurs in the network stack and happens on the user'side of things and permissions (think CLI and interpreted languges)
- billyhoffman 4y agonot exploits of the OS, but I've used this to exploit web applications quite a bit. Tricks like these get your past a lot of input filters or validation logic. This allows me to trick these apps into making HTTP requests to internal or private IPs/hosts. As an example, think of a cloud based web performance monitoring system. I trick it into making HTTP requests to 169.254.169.254, and I get access to data from their AWS metadata service...
- justsomehnguy 4y agoYep. Skipped this part (not at "he desktop RN) but honestly this is more in 'check what you accept' and input data validation|sanitation. Still a valid target for an exploit but you really need a bunch of things ('web performance monitoring system') to happen before you can have a meaningful usage (if at all) from these exploits.
- pcthrowaway 4y agoI don't know about the hex representation, but the binary representation is useful for figuring out CIDR ranges
- bobogei81123 4y agoI thought the article will mention ①②⑦.⓪.⓪.① $ ping ①②⑦.⓪.⓪.① PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
- gregschlom 4y agoThat's neat, but it's a property of the OS, though, not of IP addresses themselves :) (doesn't work on Windows btw)
- tyingq 4y ago>(doesn't work on Windows btw) Works in Gitbash in Microsoft Terminal, which is cheating a bit, but doesn't introduce a different OS. Edit: Works in Powershell too.
- 8organicbits 4y agoWorks in Firefox on Linux for me. Probably some form of unicode normalization? http://①②⑦.⓪.⓪.①:8000 http://xn--orhcp.xn--mvh.xn--mvh.xn--orh:8000 -> http://127.0.0.1:8000 http://127.0.0.1:8000
- 8organicbits 4y agoOh wow, I think HN normalized the unicode with punycode since it's a URL. I submitted with ①②⑦.⓪.⓪.① inside the http:// http:// and :8000 And the punicode version also works for me :)
- joeframbach 4y agoJavascript seems to normalize these automatically: const a = document.createElement('a'); a.href = 'http://032166163360'; console.log(a.href); // "http://209.216.230.240/" a.href = 'http://127.1' console.log(a.href); // "http://127.0.0.1/" a.href = 'http://10.50.1' console.log(a.href); // "http://10.50.0.1/" a.href = 'http://10.0.513' console.log(a.href); // "http://10.0.2.1/" a.href = 'http://0xA000201' console.log(a.href); // "http://10.0.2.1/" a.href = 'http://10.0.2.010' console.log(a.href); // "http://10.0.2.8/" and also: console.log(new URL('http://10.0.513').host) // "10.0.2.1"
- rwalle 4y agoI think you mean browser (more specifically HTML standard), not JavaScript
- LegionMammal978 4y agoIn particular, IPv4 address parsing for URL hosts is specified in https://url.spec.whatwg.org/#concept-ipv4-parser https://url.spec.whatwg.org/#concept-ipv4-parser, in WHATWG's URL Standard.
- geraldcombs 4y agoIt (and most other scripting languages) are likely just calling inet_aton under the hood.
- tinglymintyfrsh 4y agoAnd proper inet_aton allows even more formats (IPv4 only): u32 undotted u8.u24 dotted-signal u8.u8.u16 dotted-triple u8.u8.u8.u8 dotted-quad ^ where each of the above is allowed to be octal, hex, or decimal
- lucb1e 4y agoThis wasn't always the case. For years, my website had a numeric vhost configured with an easter egg but I don't think anyone ever visited it. Then I noticed, maybe four years ago, that firefox now translates the IP address into dotted quad notation and use that as a Host header instead of what the user typed, so it would never trigger now anyway. The internet used to be more fun when it was all fun and games and we didn't need to worry about every possible type of user misleading :(
- dang 4y agoDiscussed at the time: There’s more than one way to write an IP address - https://news.ycombinator.com/item?id=20390759 https://news.ycombinator.com/item?id=20390759 - July 2019 (48 comments)
- bragr 4y agoPersonally, when I was trying to wrap my head around CIDRs for the first time, thinking about IPs at one 32 bit number (a la hex formatting) was super helpful, and makes it less annoying to leave behind the nice /8 /16 /24 chunks. Thinking of terms of just bitmasks is also pretty straight forward in the end.
- macintux 4y agoI gave a class on TCP/IP to other consultants in my company 20 years ago. The day went well right up until the end when I covered bitmasks, at which point eyes universally glazed over. Lesson learned: always save that topic for last, so the rest of the day isn’t a disaster.
- NoZebra120vClip 4y agoIn community college not 5 years ago, I took the first two of a series of Cisco networking classes designed to prep for certifications such as CCNA. When we came upon CIDR and VLSM, our instructor (very knowledgeable, down-to-earth, pragmatic) introduced us to various calculators that could assist us, although he did also show us a manual way to graph out each bit. Then he admitted that the VLSM portion of the class had often driven his previous students to tears, and he didn't want to see anyone crying over this anymore.
- ggm 4y agoUnisys used commas in its presentation format. Major bummer in the late 80s commissioning a new library catalogue system.
- SergeAx 4y ago[flagged]
- chrismarlow9 4y agoReminds me of passing exponential notation to php scripts to bypass field validation and dump stack traces. Lots of security fun to be had in this space with libraries that everyone assumes have been fuzzed to death.
- deleted 4y ago[deleted]
- Pxtl 4y agoI gotta say, I realize it's got a lot of historical weight to it, but I've always hated the "leading zero means octal" thing. The fact that 12 and 012 mean drastically different things in many languages does not ever feel good.
- stevefan1999 4y agoThere’s always more than one way to write an IP address, sure, but there is only one way to canonicalize them all: remember IPv4 is just storing a mere 32-bit integer. So why not just store the straight 4 bytes?
- raffraffraff 4y agoI remember realizing I could use that trick to getting around a bluecoat proxy back in 2004. I worked in a bank, and they had draconian web filtering. DNS lookups weren't blocked, but the eeb proxy blocked sites by domain name and the ipv4 address it resolved to. However, it didn't block the ip address if you formatted it as a single 32bit integer! Of course, that would break if there was a redirect or https, but back then many sites didn't have those.
- thomashabets2 4y agoReminds me of this bug in OpenBSD: https://marc.info/?l=openbsd-bugs&m=124425026630958&w=2 https://marc.info/?l=openbsd-bugs&m=124425026630958&w=2 Of course the reply was just a deflection, even though OpenBSD was the only buggy one.