36

I am working on a change in a Java EE application that would authenticate based on the user's IP address using ServletRequest.getRemoteAddr. We store IP address ranges (FROM_IP and TO_IP) in a database and the system would authenticate only if a user's IP address falls in a range.

Now, testers have pointed out that digit 0 (zero) should not be allowed in FROM_IP and TO_IP values (in any place). Note that this is an Internet facing application, and so we will get only public IP addresses.

Are testers right in suggesting that validation? Why can't we have zero in the range value such as in 167.23.0.1 - 167.23.255.255?

Improve this question
6
  • 11
    And here's the obligatory link to the How Does Subnetting Work? question.
    – user62491
    Commented Jul 16, 2011 at 0:33
  • 8
    I find it surprising that your testers bring this up, when an IPv6 address can contain a dozen 0's. P.S. you really should make your IP address field fit IPv6 addresses if it's not too late. You'll save yourself headaches in the future.
    – Mark Henderson
    Commented Jul 16, 2011 at 2:42
  • 2
    127.0.0.1 has two zeros?
    – John Smith
    Commented Jul 16, 2011 at 16:09
  • 1
    By the way, my own IP address showing up on whatismyipaddress.com has 0 in it (67.xx.0.xx)
    – Ritesh
    Commented Jul 16, 2011 at 16:39
  • 1
    Similar question here: Is X.Y.Z.0 a valid IP address?
    – splattne
    Commented Aug 12, 2011 at 6:14

6 Answers 6

Reset to default
74

No, they are completely incorrect.

In fact, this is a valid IP address: 192.168.24.0

As is 167.23.0.1.

Separation of the IP address into dotted segments is a purely human convenience for display. It's a lot easier to remember 192.168.1.42 than 3232235818.

What matters to computers is the separation (netmask). It's not valid to have an host address with the host section of the address set entirely to 0 or 1.

So, 192.168.24.0 as long as the netmask is such that some bits get set in the host part. See the following calculations:

michael@challenger:~$ ipcalc 192.168.24.0/16
Address:   192.168.24.0         11000000.10101000. 00011000.00000000
Netmask:   255.255.0.0 = 16     11111111.11111111. 00000000.00000000
Wildcard:  0.0.255.255          00000000.00000000. 11111111.11111111
=>
Network:   192.168.0.0/16       11000000.10101000. 00000000.00000000
HostMin:   192.168.0.1          11000000.10101000. 00000000.00000001
HostMax:   192.168.255.254      11000000.10101000. 11111111.11111110
Broadcast: 192.168.255.255      11000000.10101000. 11111111.11111111
Hosts/Net: 65534                 Class C, Private Internet

In this case, the address part (right side) has 2 bits set. This is a valid host address in the 192.168.0.0/16 subnet.

michael@challenger:~$ ipcalc 192.168.24.255/16
Address:   192.168.24.255       11000000.10101000. 00011000.11111111
Netmask:   255.255.0.0 = 16     11111111.11111111. 00000000.00000000
Wildcard:  0.0.255.255          00000000.00000000. 11111111.11111111
=>
Network:   192.168.0.0/16       11000000.10101000. 00000000.00000000
HostMin:   192.168.0.1          11000000.10101000. 00000000.00000001
HostMax:   192.168.255.254      11000000.10101000. 11111111.11111110
Broadcast: 192.168.255.255      11000000.10101000. 11111111.11111111
Hosts/Net: 65534                 Class C, Private Internet

In this case, the address part has 10 bits set and 6 bits unset. This is another valid host address in the same subnet.

michael@challenger:~$ ipcalc 192.168.24.0/24
Address:   192.168.24.0         11000000.10101000.00011000. 00000000
Netmask:   255.255.255.0 = 24   11111111.11111111.11111111. 00000000
Wildcard:  0.0.0.255            00000000.00000000.00000000. 11111111
=>
Network:   192.168.24.0/24      11000000.10101000.00011000. 00000000
HostMin:   192.168.24.1         11000000.10101000.00011000. 00000001
HostMax:   192.168.24.254       11000000.10101000.00011000. 11111110
Broadcast: 192.168.24.255       11000000.10101000.00011000. 11111111
Hosts/Net: 254                   Class C, Private Internet

In this case, the address part has zero bits set. This is not a valid host address in the 192.168.24.0/24 network.

Improve this answer
13
  • 12
    I'll jump onto this answer, which is correct, to add an additional point: the "dotted quad" format for IP addresses, while canonical, is not the only representation format. Try the command ping 2130706432, or ping 017700000001 (yes, even on Windows). You may find yourself surprised by the results.
    – BMDan
    Commented Jul 16, 2011 at 0:38
  • 5
    1076000524 :)
    – jweyrich
    Commented Jul 16, 2011 at 5:07
  • 1
    While what is said here is indeed true, it is also unfortunately the case that there are a huge number of user interfaces that think a trailing zero (or 255) is bad, regardless of prefix length.
    – Theobroma Cacao
    Commented Jul 17, 2011 at 6:23
  • 2
    192.168.0.257 is incorrect, but 192.168.257 is a correct representation of 192.168.1.1 (as is 192.11010305). See inet_aton(3).
    – BMDan
    Commented Jul 19, 2011 at 2:07
  • 3
    @Raffael: subnet zero was actually a holdover from the classfull routing days. When you had, say, a Class B network (129.97.0.0/16) the zero subnet would be any network with bits 17→X all set to zero (where X is the length of the subnet). So the network 129.97.0.0/24 would be a zero subnet and disallowed in the early days. Nowadays (thankfully) we use CIDR and don't worry about that.
    – MikeyB
    Commented Jul 30, 2011 at 0:15
18

Unless I'm misunderstanding, your testers are dead wrong. Valid IP addresses can certainly have a 0 in them.

Improve this answer
13

In general: No, it doesn't matter if there is a 0 in the address or not.

However, there is a grain of truth in what your testers are saying. In some cases old or broken network equipment will not work correctly on addresses with 0 in the last octests. This is due to the old classfull routing rules. In Classfull routing, you can tell the netmask from the first octet of the address. If the equipment still follows classfull routing rules it is likely to handle an address like 200.100.1.0/16 incorrectly.

Improve this answer
4

Let's say you need 510 IP adresses in one range and your network adress is 192.1.1.0, you would have a /23 subnet, of which one of your host IP's is a .0 IP address, your testers are wrong if the .0 address is a host address. If you have a /24 network it would be right to say it was wrong.

Improve this answer
3

To provide a very simple answer: One or more zeros in an ip address are perfectly valid for host addresses as long as those addresses are not the network or broadcast address.

Network and broadcast addresses are valid ip addresses, they're just not usable by hosts.

Improve this answer
2
  • 1
    what about a broadcast address of X.Y.0.255?
    – Random832
    Commented Jul 16, 2011 at 4:38
  • 2
    You can use the network address for a host, and doing so was once a common test of "leetness". Thankfully, though, it has since fallen well out of vogue. In a similar vein, RFC 3021 permits the use of both "broadcast" and "network" addresses in a /31, though the terms are arguably somewhat inapplicable when you're only dealing with two hosts to begin with.
    – BMDan
    Commented Jul 19, 2011 at 2:13
2

If the network range contains more than 256 IPv4 addresses, some of them will contain one or more zeros. As IPv4 addresses are classless you can use sipcalc to verify.

user@linux:~ # sipcalc 10.1.0.0/8 | grep "Usable range"
Usable range            - 10.0.0.1 - 10.255.255.254

user@linux:~ # sipcalc 10.0.0.1/8 | grep "Usable range"
Usable range            - 10.0.0.1 - 10.255.255.254

user@linux:~ # sipcalc 10.0.1.0/8 | grep "Usable range"
Usable range            - 10.0.0.1 - 10.255.255.254
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .