Sort a list of addresses as text and 10.0.0.9 lands after 10.0.0.10, for the same reason any text sort puts item10 before item2. The comparison runs character by character, and "1" is less than "9".
That is the everyday cost of treating an address as a string. It is a single 32-bit integer underneath, and the moment it is stored as one the sort, the range query and the index all start behaving.
How does an address become a number?
Each octet is multiplied by its place value, in the same way each digit of a decimal number is.
| Octet | Value | Multiplier | Contribution |
|---|---|---|---|
| first | 192 | 16,777,216 | 3,221,225,472 |
| second | 168 | 65,536 | 11,010,048 |
| third | 1 | 256 | 256 |
| fourth | 1 | 1 | 1 |
The multipliers are 256 to the third, second, first and zeroth power, because each octet is worth 256 times the one after it. Adding the four contributions gives 3,232,235,777.
The reverse is repeated division by 256, taking the remainders. It is the same operation as reading a number in any other base, which is why base conversion tools and address tools are doing related arithmetic.
Why store an address as an integer?
Because comparisons become arithmetic. Asking whether an address falls inside a range is two numeric comparisons on integers, and the same question on four separate octets needs conditional logic that gets the boundaries wrong.
This is how geolocation data is distributed almost universally: a table of integer ranges with a country against each, queried with a single between clause. The dotted form would make that query slow and awkward.
The same reasoning applies to sorting. Sorted as text, 10.0.0.9 comes after 10.0.0.10, for exactly the reason any lexicographic sort puts a shorter digit string in the wrong place. Sorted as integers, addresses come out in network order.
When is the binary form the useful one?
When a boundary falls inside an octet. A prefix that ends between two octets is readable in the dotted form; one that ends part-way through the last octet is not, and writing the address out in bits shows the split immediately.
It is also the quickest way to check that a mask is well formed, since a mask is a run of ones followed by a run of zeros and anything else is not a mask. The subnetting article covers what the boundary then means.
For a stored address the binary form is a debugging view rather than a storage format. Nothing gains from keeping it.
How is a MAC address different?
It is 48 bits rather than 32, it identifies hardware rather than a position in a network, and it never leaves the local segment. Six octets, written in hex, in three formats that all mean the same thing.
The first three octets are the manufacturer prefix, assigned by a registry, and the last three are chosen by that manufacturer. That is why the first half of an address can be looked up to a vendor and the second half cannot.
Two bits in the first octet carry meaning. One marks an address as multicast rather than addressed to a single device; the other marks it as locally administered — set by software rather than drawn from a registered prefix. Phone and laptop privacy features that randomise the address set that bit, which is how a random address avoids colliding with a real one.
The addresses that never appear as a source are worth recognising too. An address of all zeros means unspecified, and one of all ones is the broadcast address for the local segment — which is why a device sending to every neighbour at once is not using a real device address at all.
Which MAC format should you use?
Whichever the system in front of you expects, since all three are the same six bytes. Colons between octets is the common Unix form, hyphens the Windows form, and dots between three groups of four hex digits the form used by some network equipment.
Reformatting between them is mechanical, and it is worth doing rather than retyping. An address transcribed by hand is the usual source of an access rule that never matches.
A generated address for testing should have the locally administered bit set. Inventing one with a real manufacturer prefix produces an address that could genuinely exist somewhere, which is a poor property for test data.
Questions people ask
Is IPv6 stored as an integer too? It needs 128 bits, so most databases keep it as binary or as a pair of 64-bit values rather than a single number.
Does the integer form work in a browser? Historically many clients accepted it in a URL, which made it a phishing technique. Modern browsers are stricter.
Are octets always under 256? Yes. Each is one byte, so 0 to 255, and a component above that is not an address.
Can a MAC address be traced to a person? Only through records held by whoever sold the device. The prefix identifies a manufacturer, nothing more.
Why does my device show a different MAC on each network? Address randomisation. It is a privacy feature and it is why a MAC is no longer a reliable device identifier.
Store the number, display the dots. IPv4 to integer and integer to IPv4 handle the database form, IPv4 to binary and binary to IPv4 make the prefix boundary visible, and the MAC address formatter and generator deal with the three notations and with test data that cannot collide.