I accidentally typed

ssh 10.0.05

instead of


and was very surprised that it worked. I also tried 10.005 and 10.5 and those also expanded automatically to I also tried 192.168.1 and that expanded to All of this also worked with ping rather than ssh, so I suspect it would work for many other commands that connect to an arbitrary user-supplied host.

Why does this work? Is this behavior documented somewhere? Is this behavior part of POSIX or something? Or is it just some weird implementation? (Using Ubuntu 13.10 for what it's worth.)


2 Answers 2


Quoting from man 3 inet_aton:

   a.b.c.d   Each of the four numeric parts specifies a byte of the
             address; the bytes are assigned in left-to-right order to
             produce the binary address.

   a.b.c     Parts a and b specify the first two bytes of the binary
             address.  Part c is interpreted as a 16-bit value that
             defines the rightmost two bytes of the binary address.
             This notation is suitable for specifying (outmoded) Class B
             network addresses.

   a.b       Part a specifies the first byte of the binary address.
             Part b is interpreted as a 24-bit value that defines the
             rightmost three bytes of the binary address.  This notation
             is suitable for specifying (outmoded) Class C network

   a         The value a is interpreted as a 32-bit value that is stored
             directly into the binary address without any byte

   In all of the above forms, components of the dotted address can be
   specified in decimal, octal (with a leading 0), or hexadecimal, with
   a leading 0X).  Addresses in any of these forms are collectively
   termed IPV4 numbers-and-dots notation.  The form that uses exactly
   four decimal numbers is referred to as IPv4 dotted-decimal notation
   (or sometimes: IPv4 dotted-quad notation).

For fun, try this:

$ nslookup unix.stackexchange.com
Non-authoritative answer:
Name:   unix.stackexchange.com

$ echo $(( (198 << 24) | (252 << 16) | (206 << 8) | 140 ))

$ ping 3338456716         # What?  What did we ping just now?
PING stackoverflow.com ( 48 data bytes
64 bytes from icmp_seq=0 ttl=52 time=75.320 ms
64 bytes from icmp_seq=1 ttl=52 time=76.966 ms
64 bytes from icmp_seq=2 ttl=52 time=75.474 ms
  • 2
    As to why, it's to provide with a more useful way to represent addresses in class A, B, C networks. For instance 127.1 is the loopback address in the 127.0/8 class A loopback network which comprises the 16 million addresses 127.0 to 127.0xffffff. And on the 192.168.0/16 class B network, you'll typically have addresses 192.168.1 to 192.168.65534. The INADDR_ANY address is 0, the DHCP broadcast address 0xffffffff which are shorter to type, etc. Mar 18, 2014 at 8:21
  • 4
    Man, I wish users would try http://1249767214 before asking simple questions like this.
    – blahdiblah
    Mar 18, 2014 at 23:37

Adding to @devnull's fine answer, IPv4 addresses can be represented in the following ways.


This domain name, google.com, can be represented in the following ways:

  •  (dotted decimal)
  • 1249763844  (flat decimal)
  • 0112.0175.0342.0004  (dotted octal)
  • 011237361004  (flat octal)
  • 0x4A.0x7D.0xE2.0x04  (dotted hex)
  • 0x4A7DE204  (flat hex)
  • 74.0175.0xe2.4  (ಠ_ಠ)

Source: Why does pinging 192.168.072 (only 2 dots) return a response from

  • 3
    Mixing octal and decimal is devil's work.
    – Etheryte
    Mar 18, 2014 at 16:18
  • 4
    A domain name is not, in any sense, an IPv4 address. Mar 18, 2014 at 20:00
  • @DavidConrad - I thought that was kind of obvious, since it's not numeric. Made it clearer for those that do not know tihs.
    – slm
    Mar 18, 2014 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .