Slashdot Mirror
UK Government Owns 16.9 Million Unused IPv4 Addresses
hypnosec writes "The Department of Work and Pensions in the UK has a /8 block of IPv4 addresses that is unused. An e-petition was created asking the DWP to sell off the block to ease the IPv4 address scarcity in the RIPE region. John Graham-Cumming, the person who first discovered the unused block, discovered that these 16.9 million IP addresses were unused after checking in the ASN database."
Just apply the real cure already... This is so ridiculous.
You have to be a UK citizen to sign the petition so please sign if you can.
An e-petition was created asking the DWP to sell off the block to ease the IPv4 address scarcity in the RIPE region.
Why not just ask them to do the right thing and give them back to RIPE? I mean seriously, what kind of example are we trying to set here? Or maybe someone's just trying to bootstrap a market for IPv4 addresses in order to cash in on the increasing scarcity....
... In any case, encouraging profit from a public resource like this is a terrible idea.
Crumb's Corollary: Never bring a knife to a bun fight.
I'll take:
I'm sure there's an algorithm or list that could tell me all of the possible "desirable" IPs in the /8, but, due to the fact that we shouldn't be greedy, and the completely arbitrary relation to the number 4 for IPv4, and the fact that it's an election year here in the US, I propose that we Slashdotters limit ourselves to four a piece, and leave the remainder to Reddit and 4chan. Or something.
Boot Windows, Linux, and ESX over the network for free.
How did nobody notice this until now? There isn't that many public /8 blocks (125 or less since the 10 and 127 blocks are for special purposes and 0 is unusable) and they've been trying to recoup unused /8 blocks for over a decade so is this really a new discovery?
This sort of thing is relatively common, it's probably used internally as a routable address space, but not intended for use on the public Internet. (Saves have to deal with multiple uses of rfc1918). This sort of thing is very common in the government (though usually much less than an /8). They can't use a consistent rfc1918 address space internally as whenever the government changes it's priorities, work units will shuffle between departments. You'll probably find that this address space is now used by many departments, and trying to move all users over to another range will cost more than they can recover from selling the /8
I enjoy the idea of the Internet actually functioning as an end-to-end network the way it was meant to, rather than one with a handful of privileged devices with publically routable addresses and (soon enough) whole cut-off sub-Internets trapped behind them. But that's just me.
"The way it was meant to" was specified by a bunch DARPA funded geeks who design their tech for a small network where all the admins knew each other. They had no concept of operating a network with large numbers of users, many of them malicious
Whenever I hear "the way it was meant to" I run the other direction. It's always based on some lame notion that things were perfect in the past, even though people in the past were also whining about "the it was meant to."
Someone used the Imperial IP which is slightly bigger than the Metric IP, hence the result is 16.9.
Mastering the English language is fucking easy: all you have to do is to put an f* word in every fucking sentence.
Ah, the widescreen version.
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
I believe in the incremental approach to updates; it's so much safer and usually easier.
So it's going to be IPv5 for me, while you suckers make a mess of IPv6!
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Local government network admin here. Parts of the 51.0.0.0/8 address space is in our internal routing table, because it's used for shared private networks between different government organisations. Just because it's not in the public Internet routing table doesn't mean it's not used.
Granted perhaps not the whole /8 is in use (I only see 3 x /16s out of a possible 256 in my routing table at present), but who's to say other sectors which I don't have network connectivity to aren't using it.
We're actually pushing for and slowly enabling IPv6 internally on our core and servers where we can, rather than delay the inevitable. This is despite our organisation ourselves owning a whole public /16 block, yet have maybe only 10-15k addressable nodes max across all our networks we control at present. It will take us much much longer to re-IP/re-subnet the entire network more efficiently so some of that space can be returned to RIPE, than for it to be reallocated and used up after returning, due to old systems and old proprietary software in use. Not to mention the resources required to do such a massive task.
Personally I think the people asking for addresses to be returned by any organisation (supposedly) not using them (including all the other apparently wasted /8 allocations out there) are not looking long term enough. IPv6 is the way to go.
Since it's been discovered, what they should do is break it up into, say ~65k blocks of 256 addresses each, and sell them only to customers who have IPv6 transition plans. In other words, these addresses should only be used to enable dual-stack for customers who have taken the initiative in moving to IPv6.
That forces people to move seriously towards IPv6 - starting w/ the telecom vendors, such as BT, Vodafone, et al. That way, the migration, instead of being pushed out, gets expedited.
Indeed, that should be the approach worldwide - provide IPv4 ONLY to supplement IPv6 blocks so that dual stack can be supported, and not any other reason.
Would privatisation of the DWP's 51.0.0.0/8 block be the first or last step to the 51st State?
Just because this block is not public does not mean it is unused.
The UK Government has a huge darknet.
First things first - for IPv6, DHCP6 is a better idea than DHCP4 was for IPv4. Use that to manage your addresses. You can assign certain addresses (or ranges) as static, certain address ranges as dynamic, and be off to the races. No need to struggle w/ subnetting the way you did in IPv4.
Next thing - if it's important for you to remember your IPv6 address, remember that the first 12-16 digits (depending on what your ISP gives you) are gonna be common. You then have the remaining 16 digits. If it's important that you remember them, set up a naming scheme for those 16 digits that works for you, and assign those names accordingly. Set it up in your DHCP6 server, so that all your devices automatically get their IPs. From that point, after a while, you should be able to remember the first half - since it's your assigned global prefix - and then the latter half, since it's something you assigned and remember. Do not use auto-configured addresses in this case.
In the event that you have money to throw @ this problem, there are even PAM (Protocol Address Management) software that some IPv6 companies provide, that help you manage your addresses. You might want to invest in those.
You're victim to Xeno's paradox: You focus on the little steps, and that clouds your perception of the big picture. There aren't enough IPv4 addresses, no matter how many are reclaimed or how efficiently they're allocated. The whole of IPv4 has a maximum of 4 billion addresses. There are already more people on this planet. Many use more than one IP enabled device at the same time. No matter how you allocate the addresses, in the end there won't be enough of them.
What's wrong with manually assigning IPv6 addresses? That works just the same as it did with IPv4:
iface eth0 inet6 static
address 2001:6a0:114::9
netmask 64
gateway 2001:6a0:114::1
iface eth0 inet static
address 192.168.0.9
netmask 255.255.255.0
gateway 192.168.0.1
You just get a much bigger range to choose from, which you may use or not.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
This must be worth more than the Bank of Scotland. Lets sell it quick. The Government is actually much more likely to hold on to it until everyone is on IPv6 and it becomes worthless.
Load balancing/failover between different ISPs:
IPv6 - ISP cooperation and 1300EUR/year,
IPv4 - NAT router with software that supports this (for example pfsense) - can be completely free and does not need ISP cooperation or knowledge.
I actually did the load balancing between two connections from the same ISP. I had DSL and could access a WiFi AP (legally), but WiFi was not very reliable. Pfsense could load balance both connections and give me faster torrents (if WiFi worked) or was just the same as with only DSL (when WiFi did not work). No additional configuration required, uT worked perfectly.
IPv6 level NAT (there are software packages for this)
any of them work on x86 Linux or Windows?
Two real servers appearing as one - it may be that the client software expects one server (and for some reason I have to have them separately, be it physical or virtual machines) or to confuse hackers. Or to keep old links working after one of the services was moved to a different server.
Essentially, NAT allows me to "decouple" the internal network from the external one - I can make it appear as I want to from the outside instead of what it actually is. Nobody outside has a need to know how my network is set up - just like the power company does not need to know what devices I have plugged in - all it sees is the total current.
Blocking a prefix, and thereby a whole host of IP addresses is easy. Targeting a specific IP address out of 18,446,744,073,709,551,616 is hard if they are static, and impossible if they are dynamic. In fact, blocking works better in IPv6 than it does in IPv4.
This is very true. IBM has 9.x.x.x. So the way they may have originally configured it may have been have 9.x.x.x to their central router, and then subnet it from that point throughout the company worldwide. So that every separate LAN within IBM would have a certain number of users. Now, if they were asked to return what they were not using, they'd have to totally re-configure their subnet centrally, and it would be a nightmare to pull off. And for what - so that other people can use them?
Agreed that IP addresses were badly allocated by Jon Postel to a select few companies, and he probably never imagined the world's entire population potentially needing it. So that's water under the bridge, and nobody should try to solve it that way. The way it's being done now- IETF owning the root, then allocating the unicast bunch to the IANA, which then allocates them to the RIRs, who then allocate them further downstream, is a good way to work. That's what people should do. The only reason for wanting to get IPv4 addresses would be to support dual stack, but for anything that is not a web server, use IPv6. That way, people don't have to scour for these addresses, and the nightmare it would be to configure them.
Usually. The problem happens when companies merge, and both are using the same "private" address space.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
I don't want somebody knowing who I'm looking up so I downloaded the entire DNS and dumped it into my /etc/hosts file. I feel so safe now....
Having a public IP that changes from time to time is mildly annoying but can be worked arround with stuff like dyndns.
Not having a public IP at all is much worse.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
"The Slashdot user known as bbn has a /48 block of IPv6 addresses that is unused. An e-petition was created ..."
I'm sorry if I haven't offended anyone
I call dibs on B16B:00B5!
Use radvd instead of DHCP6. That way IP addresses are predictable and unique, as long as you use /64 subnets which is standard practice with IPv6.
You can take a machine's MAC address and predict its IPv6 suffix perfectly. Add it to your /64's prefix and you know your IP. radvd and your clients will figure the same IP out on their own.
Somebody should make a list of all words of 4 letters of 4 letters or less, made up of A, B, C, D, E, F, G (6), I (1), O(0), S (5) and Z (2). Publish a dictionary of just those words. They can be used in composing IPv6 addresses that are easy to remember. And to make it simple, only English words for this exercise :-)
DHCP6 is if you are anal and want to explicitly exclude giving routable addresses to random devices.
The thing that's frequently missed is that you don't have the necessary CERT to do an update to the local DNS server, if you want your machine to update DNS automatically, then you need to have a CERT for a DNS server where you do have update rights.
Practically, this comes down to my laptop always being named "mylaptop.mygroup.mycompany.com" because I put the IPv6 stateless autoconfiguration address into the DNS server for "mygroup.mycompany.com" mapping it to that name with the CERT, and then the local DNS allows this as an inaddr.arpa. update because the forward check was allowed by my DNS server.
It doesn't matter if I use this address to send random SPAM, since it comes back to my domain via gethostbyaddr(). This assumes you deploy DomainKeys. If not, then the reverse name doesn't happen, and no one will be willing to relay your SPAM for you anyway.
If you care about routable addresses, then you probably need to set up a DMZ with a WiFi certificate for the non-DMZ network. This is how GoogleGuest allows people on the Google campus onto the Internet.
Class E *is* reserved space. That's why many devices refuse to allow those addresses.
Yes, a decade (plus) ago we could have wasted efforts to un-reserve that space -- and forcably reclaim all those legacy /8's. We'd still end up in exactly the same damned place... IPv4 address space isn't large enough for the global internet. The effort was instead devoted to creation of IP-ng (aka IPv6.) For all of the "designed by committee" mistakes, IPv6 is our solution. It's too god damn late to say it's trash and try to invent a new system.
The biggest failure of IP-ng is the complete lack of migration, transition, and interoperability. IPv4 and IPv6 are COMPLETELY different protocols. They might as well be Appletalk and IPX. They create to completely independant network. There is zero chance of ever getting the entire world to agree to drop v4 and go v6 at any set point. The largest sticking point here are US ISPs... they have v4 address space and their customers only want to get to v4 connected sites, thus there's zero pressure to deploy v6. (read: no consumer demand -- also zero consumer understanding) Even within the enterprise sector, there's little demand for IPv6; so again, the ISP has no pressure to support it. In fact, their plan for "the we day run out of IPv4" is carrier grade NAT, not IPv6. The IPv6 deployments of most US ISPs is a horrible joke -- AT&T's answer is 6rd - period, Legacy Bellsouth DSL... switch to Uverse: see previous answer, TWC? who knows as next to none of their customers have IPv6 connectivity, Comcast appears to be the only one headed in the right direction but at glacial speed.
IPv6 isn't an IPv4 bandaid, per se. It's a cement truck trying to pave over it. The quad-A record format was to allow v4 and v6 DNS to interoperate. One can resolve IPv6 addresses via a 100% IPv4 DNS system. It also means IPv4 only hosts can see IPv6 records ('tho they cannot talk to them.) Your suggestion would further isolate IPv6 within it's own DNS realm.
TL;DR IPv6 deployment is a matter of business need. As long as you have a v4 address and need to talk to other v4 hosts, there's no need for v6. This is the boat american companies are riding.