My question:

I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to bypass basic ACLs".

I wonder if such an "esoteric" practice is really used and, if yes, in which scenarios?

My understanding is that the filtering may occur at two layers:

  • At the application layer. Here proxies will check the domain name against a blacklist. To bypass this using an IP seems by far a more practical method,
  • At the network layer. Here firewalls will check the destination IP against a black list: as per my understanding no matter how one entered an IP address, whether he used DNS, IP, binary, or whatever, he will still get blocked.

The only theoretical scenario I can imagine is a dumb sysadmin using a badly configured proxy instead of a firewall to fake an IP-based filtering.

Is there any more real scenario? Unless my theoretical situation actually reflects real-life security issues?

The so-called "binary equivalent" stuff:

For those who don't know what I'm referring too, I think it's quite little known that a host (let's take www.google.com for example sake) can be reached through three means:

  • The most obvious: its domain name: www.google.com,
  • A more techie way: its IP address:,
  • A definitively more techie way: using the decimal representation of the IP address: 3627733732.

It is the latter which interests me here. To calculate it, you need to start from the the host's IP address:

$ host www.google.com
www.google.com has address

The book I read advised to convert each of the IP address components into binary numbers, concatenate them to get a single large binary number, and convert it back to decimal. Everyone has its own taste, personally I prefer to simply cyclically multiply by 256 and add each components as in the example below:

$ bc
((( 216 * 256) + 58) * 256 + 210) * 256 + 228

This produces a number, you can use it to access Google's server using an opaque URL like http://3627733732 or ensure that the right IP address is contacted by pinging it for instance:

$ ping 3627733732
PING 3627733732 ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=53 time=26.5 ms

This is quite a cool thing, cyber sorcerer, amaze your friends with this w0nderful 1337 trickz, great! But apart from that, I wonder if there is any real-life use for this?


Depends on the filter implementation and maybe the OS on the client machine.

As you said - the IP address will end up in the TCP packets in its binary representation, regardless of how it was originally passed to the socket software layer. Firewalls will filter for this binary address and thus catch anything - there is no way around that.

However, if the "firewall" or "proxy" is run on the machine subject to the blocking (e.g. on an employees machine instead of the company firewall), i see a way this would work:

If the "IP-Filter" is implemented as a sort of delegation-replacement for the OSes networking library (e.g. Windows Firewall / Windows Defender). When software asks for a new socket to Host XY it will check XY against a blacklist. If not blacklisted, it will pass the API-call on to the OS.
If that filter software does not take the single-number representation into account, it will allow connections to blacklisted hosts.

P.S.: I think this scenario is rather obscure. I cannot imagine that a serious sysadmin would rely on Windows Firewall or sth. similar. Also, think Windows Firewall uses a whitelists (remember these "Allow Software ABC to access the network XYZ?" dialouges?)

Not the answer you're looking for? Browse other questions tagged or ask your own question.