Slashdot Mirror
The 69/8 Networking Problem
jaredmauch writes "A number of networking providers who receive address space from ARIN have been having problems with their recent IP space allocations. This is a result of outdated filters that applied a few years ago during the boom time of the net, but have not been updated to reflect the current state of the network. Here is a paper that documents some of the problems this filtering is causing providers."
We have a few things that happened here I believe. Denial of service attacks lead the reason people would filter out 'unallocated' space. A bunch of people just used rand() to generate fake source IPs to DoS from. Dropping from unallocated or unrouted space has become commonplace as it can prevent that extra little bit of packets from reaching your firewall/router/end host. It can make the difference for some people being able to survive an attack and not. The "dot com" bubble that burst created a lot of devices that used to be cared about deeply and now are ignored by the suits as the network is too stable and runs itself. This is both good and bad. As the network becomes more reliable more people start using VoIP and other technologies that reduce costs. Problem is this ends up causing jobs to be lost. (VoIP aside, if you take 250mil phone calls all going on at the same time, using 64k per call, you've got ~16Gb/s of traffic. Most of the international backbones can easily handle this traffic. What does this mean for the existing PSTN networks once the IP networks are more reliable.) People are just busy. I know that I sometimes lag in updating software on my systems unless it's necessary. Imagine the people who think "hey, i need to update these filters" but never get around to it.
Your not going to see IPV6 untill they figure out how to bill for multicast traffic as it's REQUIRED to work inside IPv6 not optional like under v4. This is a HUGE problem in implementing it as you cant bill for it rationaly. How much sould it cost are home users going to be billed per megabit leaving there ISP? If multicast works lots of the current issues with the net can go away think bit torrent is fast think about file send loops via multicast just join as many as you have bandwith to receive. All of the routers etc etc out there have supported IPv6 for a long time I cant say that people are realy familiar with it but it could be made to work but you NEED to be able to fit a billing plan around it before any of the big guys are going ot make it work world wide.
No sir I dont like it.
0.0.0.0/1 means any address between 0.0.0.1 and 255.255.255.254. 0.0.0.0/8 is much different, meaning any address between 0.0.0.1 and 0.255.255.254. So, basically what I'm saying is that it can mean "all IP addresses (in IPv4 space)" or it can denote a smaller subset of addresses beginning at 0.0.0.1, depending on what subnet mask is applied to it.
.0 as valid IP space is also not a problem in the right network blocks.....it's broken sysadmin's understaning of IP that causes issues.
The "problem" with using blocks like that are not technical....just like using addresses ending in
Oh...and there that nasty problem of certian addresses lying on bondaries that cause routers that don't properly understand classless routing to choke, but honestly...how many edge device could possibly be out there that are that dated to still have that problem? At least how many that are in a backbone situation where their being broken would actually effect more than 10 people?
Do not fold, spindle or mutilate.
handy link on 0.0.0.0
No, that's not insightful. -1, Stupid Moderators.
There are several reasons why blocks are reserved by ARIN. Some of them are reserved because they fall on classful routing boundaries, some were reserved based on wanting to keep contiguous space free for various purposes including but not limited to RIPE and APNIC allocations, allowing flexibinity for large network to renumber out of non-contiguius space, etc.
Don't think I'm sticking up for ARIN. Their policies are poor, mostly undocumentated in their actual application, and their customer service sucks.
Do not fold, spindle or mutilate.
Jon Lewis setup a nice utility to test if your network is affected by outdated filters.
http://69box.atlantic.net/
It includes a nifty traceroute utility that you can use to test with.
As a holder of space in the 69/8 range, I'll admit the problem is annoying, but thanks to people like Jon, and this posting on Slashdot, hopefully it will go away.
It ain't just broken routers.
/29 from my DSL ISP at home. Since the whole thing runs on NAT, this gives me 8 IPs not 6, since NAT ranges have no concept of 'broadcast' or 'network' addresses (which only have link-local significance, and there's no link.)
/29 fell at the top of the /24 in question (202.59.108.248/29.) This means that 202.59.108.255 is one of the IPs which are being routed to my network. Cool, right?
I was recently assigned a
Unfortunately, the
Wrong. Having configured static NAT between that IP address and a machine on the inside of the network (172.18.16.24, case in point,) the machine was reachable from Unix and Linux machines, but not from Windows boxes.
Further testing reveals that Windows still uses classful logic to determine whether an IP is 'valid' or not. On attempting to ping 202.59.108.255 from a slew of windows 2000 boxes, tcpdump showed nothing on the other end. An identical test from a unix box showed that it worked just fine.
You're doing it wrong.
Exactly. Here are a few of the class A's that I don't see valid reason for the holder of them to have a block of such size:
019/8 Ford Motor Company (a car company)
040/8 Eli Lily and Company (a drug company)
048/8 Prudential Securities Inc. (an insurance company)
051/8 Deparment of Social Security of UK (a government department in a relatively small country that has a ridiculously unproportional share)
056/8 U.S. Postal Service (the opposite of email)
There are a handful more which you can see here: http://www.iana.org/assignments/ipv4-address-space
The fact that these companies are cyber-squatting on more than they could resonably need torques me off to the point that, if I run out of unroutables (10/8, 192.168/16, etc) for my intranetworking, I'm going to lay claim to a block or two of those class A's for my intranet and firewall them [existing squatters] off to the outside.
The whores get mad when the sluts give it away for free.
"0.0.0.0/1 means any address between 0.0.0.1 and 255.255.255.254"
Shouldn't that be "any address between 0.0.0.1 and 127.255.255.254?"