IPv4 — Protocol and Address Representations

Internet Protocol version 4 is the connectionless, best-effort datagram delivery protocol defined by RFC 791 (September 1981, Jon Postel; now STD 5). It provides two core functions: addressing (hosts identified by fixed-length 32-bit addresses) and fragmentation/reassembly of datagrams too large for the underlying network. Per RFC 791’s own scope statement, IP deliberately offers no reliability, flow control, or sequencing — those are left to host-to-host protocols like tcp riding on top of it. It sits at the internet layer of the osi-model stack.

The 32-bit address and dotted-quad notation

An IPv4 address is a 32-bit integer, conventionally written as four decimal octets separated by dots (127.0.0.1). Because the dotted-quad is only a notation, the same address can be expressed in many forms that most parsers accept:

Form	Example (= 127.0.0.1)
Dotted decimal	127.0.0.1
Plain decimal (32-bit int)	2130706433
Octal	017700000001
Hexadecimal	0x7f000001
Mixed radix	0x7f.1 (first octet hex, rest decimal)

Decimal conversion is just base-256 expansion:

$$\begin{array}{rl}\mathrm{127.0.0.1}& =(127\times 2^{24})+(0\times 2^{16})+(0\times 2^8)+(1\times 2^0)\\ & =2130706433\end{array}$$

Mixed and non-standard forms exist because the historical BSD inet_aton() parser accepted octal/hex components and fewer-than-four parts — behavior inherited by countless libraries. RFC 3986 §3.2.2 now discourages non-dotted-decimal forms in URIs, but support persists everywhere.

Security relevance: filter bypass

Alternate representations are a classic SSRF and URL-filter bypass: a blocklist matching the string 169.254.169.254 (the cloud metadata address — see ec2-instance-metadata-imds) may still pass 2852039166, 0xa9fea9fe, or 169.254.43518. Localhost filters matching 127.0.0.1 pass 2130706433 or 0x7f.1. Any SSRF mitigation must resolve and normalize the address, not string-match it.

Special-use addresses (RFC 5735)

Addresses of recurring operational/security interest:

• 127.0.0.0/8 — loopback (localhost)
• 169.254.0.0/16 — link-local; includes 169.254.169.254, the AWS/GCP/cloud instance metadata endpoint (see ec2-instance-metadata-imds)
• 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — private ranges (RFC 1918)

The metadata address in alternate forms:

169.254.169.254  =  0xa9fea9fe  =  2852039166

Sources

• RFC 791 — Internet Protocol
• RFC 5735 — Special Use IPv4 Addresses
• RFC 3986 §3.2.2 — URI Syntax (IPv4 in URIs)

See also

• arp — resolving IPv4 addresses to link-layer addresses
• tcp, udp, icmp — principal protocols carried by IPv4
• nip-io — DNS-based wildcard addressing tricks in the same filter-bypass family