5 ms·

Bad news for some ISPs, VPN setups and sysadmins I know who used these addresses as quasi private IPs (extension of 10.x.x.x), as these were all unused before..

Bad news for some ISPs, VPN setups and sysadmins I know who used these addresses as quasi private IPs (extension of 10.x.x.x), as these were all unused before...

SEJeff 11y ago
I've seen a company that uses 7.0.0.0/8 as "lucky number seven" since it is reserved for the DoD as well.
Thaxll 11y ago
What kind of company need more than 16M IPs for private adressing?
- wmf 11y ago
  A company with more than 16M cable modems, for one thing.
  - tedunangst 11y ago
    But do they all need to be on the same logical network?
    - mburns 11y ago
      They need to be logically accessible because they are managed devices. NAT doesn't work in this case. Of course, IPv6 is the more correct solution, if you can manage it (no pun intended). See Comcast's presentation about their motivations: http://meetings.ripe.net/ripe-54/presentations/IPv6_management.pdf http://meetings.ripe.net/ripe-54/presentations/IPv6_manageme...
      - tedunangst 11y ago
        Thanks, that's interesting, but doesn't explain why "federated net 10 islands" can't work, except to say it can't. New York (time warner) and Chicago (Comcast) are obviously managed separately. Why can't Comcast manage Boston and Chicago as separate networks? Is every single customer nationwide working off the same dhcp/update/management server, etc.?
        wtallis 11y ago
        Based on the kinds of multi-state outages they suffer from, I'd say they often are all having all modems hitting the same auth/DHCP/DNS servers. Back when I was on BellSouth DSL, every time they had a DNS outage everybody would reboot their modem and that would bring down the DHCP server, but if you used third-party DNS you could remain online while the entire SE US lost DSL for an hour or two.
- api 11y ago
  It's not just about number of addresses. It's also about preventing conflicts. Let's say my company uses 10.0.0.0/16. Now let's say I set up a VPN. Half my users will be on local networks that are also 10.0.x.x. Fail. Even worse, let's say my company has two locations and both use 10.0.0.x and now we want to link them on a common network using a VPN or virtual Ethernet bridge. Have fun renumbering one of these two sites, or setting up abominations like internal two-way SNAT/DNAT. The reason IPv6's address space is so huge is to allow relatively stateless assignment of addresses with extremely low probability of conflicts. An IPv6 address is basically a UUID. That's going to make lots of things easier and eliminate the need for a huge number of nasty hacks.
  - developer1 11y ago
    "An IPv6 address is basically a UUID." This is the reason why I can't believe we're not all on IPv6 yet. You would think that the online advertising industry would have done everything in their power to push IPv6, at any cost. 90%+ of people on IPv6 will literally have a unique identifier FOR LIFE on every device they own. Marketers can now pinpoint down not just to an IP address that identifies a single NAT interface, but each individual device. I hope that operating systems and/or routers will provide the option to rotate each IPv6 address on a routine basis. It would also be nice if ISPs would rotate the block that is handed out to each customer, but this is unlikely to happen. Every phone, every tablet, every PC, every thermostat, every door lock, every fridge... uniquely identifiable from the day it is hooked up to a network. :(
    - jlgaddis 11y ago
      Related: "Why the FBI wants IPv6: It's better [than CGN] for tracking criminals" [0]. [0]: http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-track-ipv4-with-nat.aspx?m=2 http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-tr...
    - mjcl 11y ago
      Good news, privacy addressing (ex. RFC 4941) exists and is enabled by default on OS X (10.7+) and Windows 7. Privacy addressing rotates the host section of the IP address by default once a day, leaving IPv6 host detection similar to IPv4+NAT. It seems like Linux may be a mixed bag (by distro) w/r/t it being enabled as default. I could definitely see cheap embedded devices based on a current Linux distro not bothering to change defaults to enable it.
frk 11y ago
Who cares ? Almost nobody will need to talk to DoD, so I would still use this subnet as private.
gnoway 11y ago
Kind of serves them right, if so. That's the kind of thoughtless violation of standards that should get used as a classroom example of what not to do.
- bg1q6lytelv 11y ago
  It's more than a little ironic to be admonishing someone for something so hackish on a website called "hacker news."
jlgaddis 11y ago
If memory serves, T-Mobile was using 5/8 internally for a long time (because they exhausted 10/8). I imagine they had a lot of fun renumbering out of that once netblocks began to be issued out of it.
- dlitz 11y ago
  I'm not sure of the timing, but today T-Mobile provides IPv6 and 464XLAT.
jlgaddis 11y ago
Yep, this is why I occasionally use reserved addresses other than the widely used RFC 1918 addresses. I use 192.0.2/24 ("TEST-NET") at home (cf. RFC 5737), split up into various subnets. At $work (ISP), we use 100.64/10 (cf. RFC 6598) quite a bit internally (for its intended purpose, *mostly). In other networks, such as companies with many locations that will be connected via VPNs or companies that will have several VPNs to other organizations (where there's less control of the addresses used), I've used 198.18/15 (cf. RFC 2544) to avoid any conflicts. Obviously, this is not what those address ranges are intended to be used for but it's certainly better than both a) using non-reserved address ranges (i.e. public ones that don't belong to you) and b) implementing funky NAT policies because of overlapping addresses.

Bad news for some ISPs, VPN setups and sysadmins I know who used these addresses as quasi private IPs (extension of 10.x.x.x), as these were all unused before...

SEJeff 11y ago

I've seen a company that uses 7.0.0.0/8 as "lucky number seven" since it is reserved for the DoD as well.

Thaxll 11y ago

What kind of company need more than 16M IPs for private adressing?

wmf 11y ago
A company with more than 16M cable modems, for one thing.
- tedunangst 11y ago
  But do they all need to be on the same logical network?
  - mburns 11y ago
    They need to be logically accessible because they are managed devices. NAT doesn't work in this case. Of course, IPv6 is the more correct solution, if you can manage it (no pun intended). See Comcast's presentation about their motivations: http://meetings.ripe.net/ripe-54/presentations/IPv6_management.pdf http://meetings.ripe.net/ripe-54/presentations/IPv6_manageme...
    - tedunangst 11y ago
      Thanks, that's interesting, but doesn't explain why "federated net 10 islands" can't work, except to say it can't. New York (time warner) and Chicago (Comcast) are obviously managed separately. Why can't Comcast manage Boston and Chicago as separate networks? Is every single customer nationwide working off the same dhcp/update/management server, etc.?
      - wtallis 11y ago
        Based on the kinds of multi-state outages they suffer from, I'd say they often are all having all modems hitting the same auth/DHCP/DNS servers. Back when I was on BellSouth DSL, every time they had a DNS outage everybody would reboot their modem and that would bring down the DHCP server, but if you used third-party DNS you could remain online while the entire SE US lost DSL for an hour or two.
api 11y ago
It's not just about number of addresses. It's also about preventing conflicts. Let's say my company uses 10.0.0.0/16. Now let's say I set up a VPN. Half my users will be on local networks that are also 10.0.x.x. Fail. Even worse, let's say my company has two locations and both use 10.0.0.x and now we want to link them on a common network using a VPN or virtual Ethernet bridge. Have fun renumbering one of these two sites, or setting up abominations like internal two-way SNAT/DNAT. The reason IPv6's address space is so huge is to allow relatively stateless assignment of addresses with extremely low probability of conflicts. An IPv6 address is basically a UUID. That's going to make lots of things easier and eliminate the need for a huge number of nasty hacks.
- developer1 11y ago
  "An IPv6 address is basically a UUID." This is the reason why I can't believe we're not all on IPv6 yet. You would think that the online advertising industry would have done everything in their power to push IPv6, at any cost. 90%+ of people on IPv6 will literally have a unique identifier FOR LIFE on every device they own. Marketers can now pinpoint down not just to an IP address that identifies a single NAT interface, but each individual device. I hope that operating systems and/or routers will provide the option to rotate each IPv6 address on a routine basis. It would also be nice if ISPs would rotate the block that is handed out to each customer, but this is unlikely to happen. Every phone, every tablet, every PC, every thermostat, every door lock, every fridge... uniquely identifiable from the day it is hooked up to a network. :(
  - jlgaddis 11y ago
    Related: "Why the FBI wants IPv6: It's better [than CGN] for tracking criminals" [0]. [0]: http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-track-ipv4-with-nat.aspx?m=2 http://gcn.com/articles/2012/06/07/fbi-wants-ipv6-hard-to-tr...
  - mjcl 11y ago
    Good news, privacy addressing (ex. RFC 4941) exists and is enabled by default on OS X (10.7+) and Windows 7. Privacy addressing rotates the host section of the IP address by default once a day, leaving IPv6 host detection similar to IPv4+NAT. It seems like Linux may be a mixed bag (by distro) w/r/t it being enabled as default. I could definitely see cheap embedded devices based on a current Linux distro not bothering to change defaults to enable it.

frk 11y ago

Who cares ? Almost nobody will need to talk to DoD, so I would still use this subnet as private.

gnoway 11y ago

Kind of serves them right, if so. That's the kind of thoughtless violation of standards that should get used as a classroom example of what not to do.

bg1q6lytelv 11y ago
It's more than a little ironic to be admonishing someone for something so hackish on a website called "hacker news."

jlgaddis 11y ago

If memory serves, T-Mobile was using 5/8 internally for a long time (because they exhausted 10/8). I imagine they had a lot of fun renumbering out of that once netblocks began to be issued out of it.

dlitz 11y ago
I'm not sure of the timing, but today T-Mobile provides IPv6 and 464XLAT.

jlgaddis 11y ago

Yep, this is why I occasionally use reserved addresses other than the widely used RFC 1918 addresses. I use 192.0.2/24 ("TEST-NET") at home (cf. RFC 5737), split up into various subnets. At $work (ISP), we use 100.64/10 (cf. RFC 6598) quite a bit internally (for its intended purpose, *mostly). In other networks, such as companies with many locations that will be connected via VPNs or companies that will have several VPNs to other organizations (where there's less control of the addresses used), I've used 198.18/15 (cf. RFC 2544) to avoid any conflicts. Obviously, this is not what those address ranges are intended to be used for but it's certainly better than both a) using non-reserved address ranges (i.e. public ones that don't belong to you) and b) implementing funky NAT policies because of overlapping addresses.