Reading IP addresses in hex from packet captures and logs

When analyzing packet captures in Wireshark, reviewing raw syslog output, or examining memory dumps during incident response, you will often encounter IP addresses stored or displayed in hexadecimal format. Unlike the familiar dotted-decimal notation (192.168.1.1), hex representation can be difficult to read at a glance. Understanding how to quickly convert between these formats is essential for network troubleshooting, security analysis, and certification lab work.

Why IP addresses appear in hex

IP addresses are 32-bit values. When stored in memory, packet headers, or binary logs, they exist as four consecutive bytes. Some tools and protocols display these bytes in hexadecimal for compactness or because they are dumping raw binary data. Tcpdump output, netstat on some Unix systems, and low-level packet inspection tools often show addresses this way. Understanding the underlying representation helps you map what you see on screen back to the actual network address.

The conversion process

An IPv4 address consists of four octets, each ranging from 0 to 255 in decimal. In hexadecimal, each octet is represented as two hex digits (00 to FF). The conversion follows a straightforward pattern:

• →Each pair of hex digits represents one octet
• →Convert each pair from hex to decimal
• →Separate the four decimal values with dots
• →The result is your standard dotted-decimal IP address

For example, the hex value C0A80101 breaks down as:

Hex:     C0    A8    01    01
Decimal: 192   168   1     1
Result:  192.168.1.1

The hex digits A through F represent decimal values 10 through 15. C0 in hex equals (12 * 16) + 0 = 192 in decimal. A8 equals (10 * 16) + 8 = 168. This same logic applies to all pairs.

Common formats you will encounter

Hex IP addresses appear in different styles depending on the source tool or protocol:

• →Continuous hex: C0A80101 (no separators)
• →Colon-separated: C0:A8:01:01 (common in tcpdump and memory dumps)
• →Dot-separated: C0.A8.01.01 (less common but seen in some logs)
• →0x prefix: 0xC0A80101 (indicates hex notation explicitly)
• →Lowercase: c0a80101 (equivalent to uppercase, just different convention)

Regardless of format, the conversion method remains the same: extract each pair of hex digits and convert to decimal.

Practical troubleshooting example

Suppose you are reviewing a raw packet dump and see the source address listed as 7F00:0001. This is localhost in hex format:

Hex:     7F    00    00    01
Decimal: 127   0     0     1
Result:  127.0.0.1

Another example from a firewall log shows the destination as 08080808:

Hex:     08    08    08    08
Decimal: 8     8     8     8
Result:  8.8.8.8

These conversions let you immediately recognize what traffic is actually flowing through your network, rather than trying to mentally parse hex strings during live troubleshooting.

Speed up your workflow

While manual conversion is straightforward, doing it repeatedly during packet analysis or lab work slows you down. A dedicated converter tool eliminates mental math and reduces transcription errors, letting you focus on the actual network problem rather than format translation.