Binary, Hex & Number Systems
A complete, gap-free treatment of every number system used in networking — binary, hexadecimal, octal, and decimal — plus bitwise operations, two's complement, endianness, and how they appear in IP addresses, MAC addresses, subnets, and packet headers.
// CHAPTER 01
Why Number Systems Matter in Networking
Binary and hex are not abstract math — they are everywhere in protocols
Every network protocol is ultimately a specification of bits. IPv4 addresses are 32-bit binary numbers. MAC addresses are 48-bit hex numbers. A TCP port number is a 16-bit unsigned integer. A subnet mask is a sequence of 1s followed by 0s. VLAN tags, DSCP values, TTL fields, sequence numbers, checksum calculations — all require you to think in binary and hexadecimal fluently.
Engineers who only work in decimal are forced to convert mentally — and they make mistakes. An engineer fluent in binary and hex reads 0xFF and instantly knows it's 255, a full octet of ones, a broadcast address octet or a fully-set mask. They see /24 and immediately know the mask is 11111111.11111111.11111111.00000000 = 255.255.255.0. This chapter builds that fluency from first principles.
// REAL-WORLD SCENARIO
// CHAPTER 02
Positional Number Systems
How any base works — the universal framework
All positional number systems follow the same rule: the value of a digit depends on its position. Each position represents a power of the base. You already know this from decimal — you just never thought about why.
Every number system uses exactly this framework. Once you understand it in decimal, understanding binary (base 2) and hex (base 16) is just swapping the base. The only difference: what digits are available. Decimal has 10 digits (0–9). Binary has 2 (0–1). Hex has 16 (0–9, then A–F representing 10–15).
Powers of 2 — Memorize These
Binary powers of 2 appear constantly in networking. Memorizing at least through 2¹⁶ pays off immediately:
// CHAPTER 03
Binary (Base 2)
The native language of every computer and network device
Binary is not a convenience — it is the only number system that maps directly to the physical reality of digital electronics. A transistor is either on (saturated) or off (cut off). A capacitor is either charged or discharged. Voltage is either above a threshold (1) or below it (0). Binary digit = bit (binary digit). All other representations are abstractions built on top of binary.
Converting Decimal to Binary
Two methods. The subtraction method is fastest for networking (IP addresses, subnet masks):
Converting Binary to Decimal
Write down the bit values for each position, multiply each bit by its position value, sum the results:
Bits, Nibbles, Bytes, and Words
Bit: One binary digit (0 or 1). The fundamental unit.
Nibble: 4 bits. Can represent values 0–15. Exactly one hex digit. Why nibbles matter: you split a byte into two nibbles to convert to hex. A VLAN ID (12 bits) is three nibbles.
Byte (octet): 8 bits. Can represent 256 values (0–255). One IPv4 address octet. One ASCII character. In networking, "octet" is technically more precise than "byte" because "byte" historically meant variable bit counts (5, 6, 7, or 8 bits) — the term "octet" always means exactly 8 bits.
Word: Platform-dependent — historically 16 bits on 16-bit systems, 32 bits on 32-bit, 64 bits on 64-bit. In networking, "word" usually means 32 bits (IPv4 header fields are measured in 32-bit words — the IHL field says "header length in 32-bit words").
// CHAPTER 04
Hexadecimal (Base 16)
The compact notation for binary data
Hexadecimal exists for one reason: binary is hard to read for humans. A 48-bit MAC address in binary is 48 characters of 0s and 1s — impossible to parse at a glance. In hex, the same address is 12 characters: A4:C3:F0:85:AC:2B. Every group of 4 binary bits maps to exactly one hex digit. This makes hex the natural compression format for binary data.
Hex Digits
Binary ↔ Hex: The 4-Bit Shortcut
Because 16 = 2⁴, every group of exactly 4 binary bits corresponds to exactly one hex digit. This makes conversion trivial — no arithmetic needed:
Hex in Networking — Where You See It
MAC addresses: 48-bit addresses written as 6 hex octets: A4:C3:F0:85:AC:2B. The first 3 octets (OUI — Organizationally Unique Identifier) identify the manufacturer. Wireshark resolves OUIs to vendor names.
IPv6 addresses: 128-bit addresses written as 8 groups of 4 hex digits: 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Each group is 16 bits = 4 hex digits. Consecutive groups of all zeros can be compressed with ::.
Ethernet EtherType field: 2-byte hex code in every Ethernet frame header identifying the Layer 3 protocol: 0x0800 = IPv4, 0x0806 = ARP, 0x86DD = IPv6, 0x8100 = VLAN (802.1Q).
Packet captures (Wireshark/tcpdump): The hex dump view shows raw packet bytes in hex pairs. Reading a packet header directly requires converting hex fields to understand protocol values.
Cryptography and TLS: Keys, IVs, hashes, certificate fingerprints — all expressed in hex. A SHA-256 hash is 256 bits = 32 bytes = 64 hex characters.
// NUMBER BASE CONVERTER
Input value
From base
Binary (base 2) 0b
0b11000000
digits: 0–1
Octal (base 8) 0o
0o300
digits: 0–7
Decimal (base 10)
192
digits: 0–9
Hex (base 16) 0x
0xC0
digits: 0–9,A–F
Binary bit groups (nibbles)
1100
C
0000
0
Each group of 4 binary digits = 1 hex digit. Decimal value: 192
// CHAPTER 05
Octal (Base 8)
Less common today, but still appears in Unix file permissions
Octal (base 8) uses digits 0–7. Each octal digit represents exactly 3 binary bits. Octal was more common when computers had 6-bit, 12-bit, or 36-bit architectures. In modern networking, octal is rare — but you'll encounter it in one critical context: Unix/Linux file permissions.
Binary ↔ Octal
Group binary bits in sets of 3 (from the right) to convert to octal — each group of 3 bits = one octal digit:
// CHAPTER 06
Number System Conversions — Complete Reference
Every conversion path, with worked examples
The converter below lets you practice all conversions interactively. The conceptual map of all conversion paths:
// IPv4 ADDRESS BINARY BREAKDOWN
IP Address
| Octet | Decimal | Binary (8 bits) | Hex |
|---|---|---|---|
| Octet 1 | 192 | 11000000 | 0xC0 |
| Octet 2 | 168 | 10101000 | 0xA8 |
| Octet 3 | 1 | 00000001 | 0x01 |
| Octet 4 | 1 | 00000001 | 0x01 |
Full 32-bit binary representation
11000000.10101000.00000001.00000001
Hex: C0:A8:01:01 | Decimal: 3232235777
// CHAPTER 07
Signed Numbers and Two's Complement
How negative numbers work in binary — and why it matters for protocol fields
Networking protocol fields are mostly unsigned integers (port numbers, TTL, sequence numbers are always non-negative). But understanding signed binary arithmetic matters when: reading C code that parses headers, understanding TCP sequence number wraparound, analyzing signed vs unsigned overflow vulnerabilities, and working with routing metrics that can be negative.
Sign-Magnitude (naive approach — not used)
The obvious idea: use the most-significant bit as a sign bit (0 = positive, 1 = negative), with the remaining bits as the magnitude. Problem: two representations of zero (+0 = 00000000, -0 = 10000000), and subtraction circuits don't simplify. This approach was used in very early computers but abandoned.
Two's Complement (universal standard)
In two's complement, the MSB has a negative positional value: for an 8-bit signed integer, bit 7 = -128 instead of +128. All other bits retain their normal positive values.
Computing Two's Complement (negating a number)
To negate a number in two's complement: invert all bits, then add 1.
Integer Overflow and TCP Sequence Numbers
TCP sequence numbers are 32-bit unsigned integers (0 to 4,294,967,295). They wrap around: after 4,294,967,295, the next sequence number is 0. TCP is designed to handle this correctly using modular arithmetic comparisons — SEQ_GT(a, b) uses (a - b) > 0 with unsigned arithmetic to handle wraparound.
On a 10 Gbps link transferring data at full speed: 10 Gbps = 1.25 GB/s. 4 GB / 1.25 GB/s = 3.2 seconds to cycle through all sequence numbers. The TCP Protection Against Wrapped Sequences (PAWS) extension uses timestamps to disambiguate wrapped-around sequence numbers.
// CHAPTER 08
Bitwise Operations in Networking
AND, OR, XOR, NOT, shifts — the operations behind subnetting and headers
Bitwise operations work on individual bits of a number. They are not abstract algebra — they appear constantly in real protocol processing: subnet calculation, header field extraction, flag setting/testing, and checksum computation.
// BITWISE OPERATIONS VISUALIZER
A (0–255)
B (0–255)
Both bits must be 1 → 1. Used for masking (extracting specific bits). Subnet masking is AND.
AND — Subnet Masking
Bitwise AND is the operation behind every subnet calculation. To find the network address of an IP address: Network = IP AND Subnet Mask
OR — Setting Bits
OR sets specific bits to 1 without affecting others. Used to: calculate broadcast addresses, set flag fields in headers, construct IP addresses from network+host portions.
XOR — Checksums and Encryption
XOR has a unique property: A XOR B XOR B = A. XORing with the same value twice gives back the original. This makes XOR the foundation of stream ciphers (one-time pad: ciphertext = plaintext XOR key; recover plaintext = ciphertext XOR key). It's also used in RAID-5/6 parity: Parity = Block1 XOR Block2 XOR Block3. If one block is lost, it's recovered by XOR of the remaining blocks with parity.
NOT — Inverting Masks
Bitwise NOT flips every bit. In networking: Wildcard mask = NOT(Subnet mask). Cisco ACLs use wildcard masks (inverted subnet masks). A wildcard mask of 0.0.0.255 means "match any value in the last octet."
Bit Shifts — Extracting Header Fields
Left shift (<<) multiplies by 2ⁿ. Right shift (>>) divides by 2ⁿ. In networking, shifts extract or insert multi-bit fields within a byte or word:
✗ Common Mistake — Forgetting operator precedence in bitwise expressions
In C and most languages, x & 0x0F == 0 is evaluated as x & (0x0F == 0) — not (x & 0x0F) == 0 — because == has higher precedence than &. This is a real source of bugs in packet parsing code. Always use explicit parentheses: (x & 0x0F) == 0.
// CHAPTER 09
Binary in IP Addressing and Subnetting
Binary thinking is the only way to truly understand IP
IPv4 addresses and subnet masks only make sense in binary. Decimal notation (192.168.1.0/24) is a human-readable convenience — every routing and forwarding decision is made in binary.
CIDR Prefix Length
A CIDR prefix /N means the first N bits are the network portion and the remaining (32-N) bits are the host portion. The subnet mask is simply N consecutive 1s followed by (32-N) zeros:
Subnetting Step by Step (Binary Method)
Given: network 192.168.1.0/24, need 4 equal subnets. Each subnet borrows 2 bits (2² = 4 subnets):
Is This Host in This Subnet? (Binary Test)
To determine if two addresses are in the same subnet, AND both with the subnet mask and compare the results:
🔢 IPv6 addresses and hex
IPv6 addresses are 128 bits, written as 8 groups of 4 hex digits (32 hex chars total). 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Two compression rules: (1) leading zeros in each group can be omitted: 2001:db8:85a3:0:0:8a2e:370:7334; (2) one consecutive run of all-zero groups can be replaced with ::: 2001:db8:85a3::8a2e:370:7334. The :: can only appear once. IPv6 prefix length works the same as IPv4: /64 means the first 64 bits are the network prefix.
// CHAPTER 10
Endianness
Byte order — why the same number looks different on different machines
When a multi-byte number (like a 32-bit IP address or a 16-bit port number) is stored in memory or transmitted over a network, the bytes must be placed in some order. Endianness is the convention that determines which byte comes first.
Big-Endian vs Little-Endian
Big-endian (network byte order): the most significant byte (MSB) is stored at the lowest memory address / sent first on the wire. Storing the 32-bit value 0x12345678 in memory starting at address 0x1000:
Why It Matters for Networking Code
x86/x86-64 CPUs (virtually all PCs and servers) are little-endian. Network protocols are big-endian. Every time you read a multi-byte field from a packet in C code, you must convert:
Wireshark and Endianness
Wireshark handles byte-order conversion transparently — it reads raw network (big-endian) bytes and displays them as human-readable decimal or hex values. When you see a TCP port of 443 in Wireshark, the actual bytes in the packet are 0x01 0xBB (big-endian: 0×256 + 187 = 443). If you look at the raw hex dump in Wireshark's packet bytes panel, you'll see these raw bytes.
⚠ Endianness trap in protocol parsing
A common bug: reading a 16-bit port number without byte-swap conversion on a little-endian machine. Port 443 (0x01BB) would be read as 0xBB01 = 47873 — completely wrong. Always use htons/ntohs (C) or struct.pack with '!' prefix (Python) for any multi-byte field read from a packet.
// CHAPTER 11
Binary in Packet Headers
Reading real protocol headers in hex and binary
Everything you've learned now combines. Let's read a real IPv4 header byte by byte, extracting every field in binary and hex.
IPv4 Header — Binary Field Extraction
TCP Header — Binary Field Extraction
MAC Address OUI Lookup
// CHAPTER 12
Practical Tools for Binary and Hex
Working with binary in the real world
Theory is only useful if you can apply it at the command line, in code, and in protocol analysis tools.
Command-Line Number Conversions
ipcalc — Subnet Calculator
Wireshark Hex Dump
In Wireshark: select any packet → bottom panel shows raw bytes. Left column = hex pairs, right column = ASCII interpretation (dots for non-printable bytes). Clicking on a field in the middle panel highlights the corresponding hex bytes at the bottom. This is how you verify your binary/hex understanding against real traffic.
// CHAPTER 13
Interview Questions
From beginner to PhD
Convert 172.16.5.0/22 to binary. How many hosts does this subnet support?
What is 0xC0A80101? What is its significance in networking?
A router receives a packet for 10.10.15.200. Its routing table has 10.10.0.0/16 and 10.10.15.0/24. Which route wins and why?
Explain the TCP flags byte: what does 0x12 mean, and how do you extract individual flags using bitwise operations?
syn = (flags >> 1) & 1, ack = (flags >> 4) & 1. Or test: is_ack = (flags & 0x10) != 0.What is network byte order? Why does it exist, and what happens if you forget to convert in a protocol parser?
Explain how IPv6 address compression works. What is the full expansion of 2001:db8::1? Design an algorithm to compress an IPv6 address.
Full expansion of 2001:db8::1: the :: replaces all consecutive zero groups needed to make 8 total. 2001:db8 is 2 groups → 5 zero groups needed → 2001:0db8:0000:0000:0000:0000:0000:0001.
Compression algorithm: (1) Split address into 8 16-bit groups. (2) Find all runs of consecutive zero groups. (3) Replace the longest run with :: (if tie, replace the first). (4) Within each remaining group, remove leading zeros. RFC 5952 adds tie-breaking rules: if equal-length zero runs exist, replace the first one; the compressed form must be canonical (lowercase hex). Edge cases: 0:0:0:0:0:0:0:1 → ::1 (loopback); 0:0:0:0:0:0:0:0 → :: (unspecified); IPv4-mapped: 0:0:0:0:0:FFFF:C0A8:0101 → ::ffff:192.168.1.1.
🎯 Key Takeaways
- ✓All positional number systems follow the same rule: digit value × base^position. Binary (base 2) and hex (base 16) are just different bases of the same framework.
- ✓Binary is the native language of computers — every IP address, MAC address, port number, and header field is ultimately a binary number. Decimal and hex are human conveniences.
- ✓Each hex digit represents exactly 4 binary bits (a nibble). This makes hex ↔ binary conversion trivial — group bits in sets of 4 and look up the table.
- ✓Memorize powers of 2 through 2¹⁶: 2⁸=256 (IPv4 octet range), 2¹⁶=65536 (port numbers), 2³²=4.3 billion (IPv4 address space).
- ✓Two's complement is the universal standard for signed integers: negate by inverting all bits then adding 1. MSB has a negative weight (-128 for 8-bit).
- ✓AND is subnet masking (network = IP & mask). OR sets bits (broadcast = network | wildcard). XOR is used in CRC, parity, and encryption. NOT inverts masks (wildcard = NOT mask).
- ✓CIDR prefix /N means N bits of network, (32-N) bits of host. 2^(32-N) - 2 = usable hosts. Subnet boundaries are always multiples of 2^(32-N).
- ✓Network byte order is big-endian (MSB first). x86/x86-64 CPUs are little-endian. Always use ntohs/ntohl (C) or struct with "!" (Python) when reading multi-byte fields from packets.
- ✓IPv6 uses 128-bit hex addresses. Leading zeros in each group and consecutive all-zero groups (::) can be compressed. :: can only appear once per address.
- ✓Bitwise operations on header fields: shift right to extract upper nibble (version), AND with mask to extract lower nibble (IHL), shift left to reconstruct. Always parenthesize bitwise expressions.
- ✓ipcalc, Python struct/socket, and Wireshark hex dump are the practical tools for binary/hex work. Wireshark shows raw hex with field highlighting for protocol learning.
Discussion
0Have a better approach? Found something outdated? Share it — your knowledge helps everyone learning here.