Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on a change in a Java EE application that would authenticate based on the user's IP address using ServletRequest.getRemoteAddr. We store IP address ranges (FROM_IP and TO_IP) in a database and the system would authenticate only if a user's IP address falls in a range.

Now, testers have pointed out that digit 0 (zero) should not be allowed in FROM_IP and TO_IP values (in any place). Note that this is an Internet facing application, and so we will get only public IP addresses.

Are testers right in suggesting that validation? Why can't we have zero in the range value such as in 167.23.0.1 - 167.23.255.255?

share|improve this question
11  
And here's the obligatory link to the How Does Subnetting Work? question. –  kce Jul 16 '11 at 0:33
7  
I find it surprising that your testers bring this up, when an IPv6 address can contain a dozen 0's. P.S. you really should make your IP address field fit IPv6 addresses if it's not too late. You'll save yourself headaches in the future. –  Mark Henderson Jul 16 '11 at 2:42
    
127.0.0.1 has two zeros? –  John Smith Jul 16 '11 at 16:09
1  
By the way, my own IP address showing up on whatismyipaddress.com has 0 in it (67.xx.0.xx) –  Ritesh Jul 16 '11 at 16:39
1  
Similar question here: Is X.Y.Z.0 a valid IP address? –  splattne Aug 12 '11 at 6:14
show 1 more comment

5 Answers

up vote 66 down vote accepted

No, they are completely incorrect.

In fact, this is a valid IP address: 192.168.24.0

As is 167.23.0.1.

Separation of the IP address into dotted segments is a purely human convenience for display. It's a lot easier to remember 192.168.1.42 than 3232235818.

What matters to computers is the separation (netmask). It's not valid to have an host address with the host section of the address set entirely to 0 or 1.

So, 192.168.24.0 as long as the netmask is such that some bits get set in the host part. See the following calculations:


michael@challenger:~$ ipcalc 192.168.24.0/16
Address:   192.168.24.0         11000000.10101000. 00011000.00000000
Netmask:   255.255.0.0 = 16     11111111.11111111. 00000000.00000000
Wildcard:  0.0.255.255          00000000.00000000. 11111111.11111111
=>
Network:   192.168.0.0/16       11000000.10101000. 00000000.00000000
HostMin:   192.168.0.1          11000000.10101000. 00000000.00000001
HostMax:   192.168.255.254      11000000.10101000. 11111111.11111110
Broadcast: 192.168.255.255      11000000.10101000. 11111111.11111111
Hosts/Net: 65534                 Class C, Private Internet

In this case, the address part (right side) has 2 bits set. This is a valid host address is the 192.168.0.0/16 subnet.


michael@challenger:~$ ipcalc 192.168.24.255/16
Address:   192.168.24.255       11000000.10101000. 00011000.11111111
Netmask:   255.255.0.0 = 16     11111111.11111111. 00000000.00000000
Wildcard:  0.0.255.255          00000000.00000000. 11111111.11111111
=>
Network:   192.168.0.0/16       11000000.10101000. 00000000.00000000
HostMin:   192.168.0.1          11000000.10101000. 00000000.00000001
HostMax:   192.168.255.254      11000000.10101000. 11111111.11111110
Broadcast: 192.168.255.255      11000000.10101000. 11111111.11111111
Hosts/Net: 65534                 Class C, Private Internet

In this case, the address part has 10 bits set and 6 bits unset. This is another valid host address in the same subnet.


michael@challenger:~$ ipcalc 192.168.24.0/24
Address:   192.168.24.0         11000000.10101000.00011000. 00000000
Netmask:   255.255.255.0 = 24   11111111.11111111.11111111. 00000000
Wildcard:  0.0.0.255            00000000.00000000.00000000. 11111111
=>
Network:   192.168.24.0/24      11000000.10101000.00011000. 00000000
HostMin:   192.168.24.1         11000000.10101000.00011000. 00000001
HostMax:   192.168.24.254       11000000.10101000.00011000. 11111110
Broadcast: 192.168.24.255       11000000.10101000.00011000. 11111111
Hosts/Net: 254                   Class C, Private Internet

In this case, the address part has zero bits set. This is not a valid host address in the 192.168.24.0/24 network.

share|improve this answer
11  
I'll jump onto this answer, which is correct, to add an additional point: the "dotted quad" format for IP addresses, while canonical, is not the only representation format. Try the command ping 2130706432, or ping 017700000001 (yes, even on Windows). You may find yourself surprised by the results. –  BMDan Jul 16 '11 at 0:38
5  
1076000524 :) –  jweyrich Jul 16 '11 at 5:07
1  
While what is said here is indeed true, it is also unfortunately the case that there are a huge number of user interfaces that think a trailing zero (or 255) is bad, regardless of prefix length. –  Theobroma Cacao Jul 17 '11 at 6:23
1  
192.168.0.257 is incorrect, but 192.168.257 is a correct representation of 192.168.1.1 (as is 192.11010305). See inet_aton(3). –  BMDan Jul 19 '11 at 2:07
2  
@Raffael: subnet zero was actually a holdover from the classfull routing days. When you had, say, a Class B network (129.97.0.0/16) the zero subnet would be any network with bits 17→X all set to zero (where X is the length of the subnet). So the network 129.97.0.0/24 would be a zero subnet and disallowed in the early days. Nowadays (thankfully) we use CIDR and don't worry about that. –  MikeyB Jul 30 '11 at 0:15
show 9 more comments

Unless I'm misunderstanding, your testers are dead wrong. Valid IP addresses can certainly have a 0 in them.

share|improve this answer
add comment

In general: No, it doesn't matter if there is a 0 in the address or not.

However, there is a grain of truth in what your testers are saying. In some cases old or broken network equipment will not work correctly on addresses with 0 in the last octests. This is due to the old classfull routing rules. In Classfull routing, you can tell the netmask from the first octet of the address. If the equipment still follows classfull routing rules it is likely to handle an address like 200.100.1.0/16 incorrectly.

share|improve this answer
add comment

Let's say you need 510 IP adresses in one range and your network adress is 192.1.1.0, you would have a /23 subnet, of which one of your host IP's is a .0 IP address, your testers are wrong if the .0 address is a host address. If you have a /24 network it would be right to say it was wrong.

share|improve this answer
add comment

To provide a very simple answer: One or more zeros in an ip address are perfectly valid for host addresses as long as those addresses are not the network or broadcast address.

Network and broadcast addresses are valid ip addresses, they're just not usable by hosts.

share|improve this answer
1  
what about a broadcast address of X.Y.0.255? –  Random832 Jul 16 '11 at 4:38
    
Modified my answer. Thanks fot catching that. –  joeqwerty Jul 16 '11 at 13:51
2  
You can use the network address for a host, and doing so was once a common test of "leetness". Thankfully, though, it has since fallen well out of vogue. In a similar vein, RFC 3021 permits the use of both "broadcast" and "network" addresses in a /31, though the terms are arguably somewhat inapplicable when you're only dealing with two hosts to begin with. –  BMDan Jul 19 '11 at 2:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.