3 ms·

Surprised that he missed out 192.168.0.0/16

by infinity0 8y ago

signa11 8y ago
why ? these are non routable...
- rocqua 8y ago
  It is missing from the table of reserved ip addresses. He mentions: 0.0.0.0/8 Local System 10.0.0.0/8 Local LAN 127.0.0.0/8 Loopback 169.254.0.0/16 “Link Local” 172.16.0.0/12 Local LAN 224.0.0.0/4 Multicast 240.0.0.0/4 “Future use”
- jlgaddis 8y ago
  That was infinity0's point -- there's no reason to scan them.
jlgaddis 8y ago
He also left out a bunch of other networks that one wouldn't really need to scan: 100.64.0.0/10 [0] and 198.18.0.0/15 [1] (and a bunch of /24s [2,3,4] too but, relatively speaking, those are pretty insignificant), although one might find some "interesting" (CGN) stuff in 100.64.0.0/10 if their ISP was making use of it. There are also large portions of the 13 /8s (218 million IPs!) assigned to the US Department of Defense [5] that you wouldn't need to scan since there are no routes to them at all: the 11.0.0.0/8, 22.0.0.0/8, 26.0.0.0/8, 28.0.0.0/8, 29.0.0.0/8, 30.0.0.0/8, and 33.0.0.0/8 networks are, for all intents and purposes, "missing" from the public Internet. Additionally, there are only four /24s in 21.0.0.0/8 that are reachable from the public Internet. Out of the 16,777,216 IP addresses that make up 7.0.0.0/8, only 255 are reachable (7.7.7.0/24) [6]. There's pretty much no point in scanning -- "mapping" -- this address place (unless you are looking specifically for US government/military stuff). ETA: In the interest of time, you probably wanna skip over 44.0.0.0/8 [7] also. [0]: https://tools.ietf.org/html/rfc6598 https://tools.ietf.org/html/rfc6598 [1]: https://tools.ietf.org/html/rfc2544 https://tools.ietf.org/html/rfc2544 [2]: https://tools.ietf.org/html/rfc5737 https://tools.ietf.org/html/rfc5737 [3]: https://tools.ietf.org/html/rfc3068 https://tools.ietf.org/html/rfc3068 [4]: https://tools.ietf.org/html/rfc7534 https://tools.ietf.org/html/rfc7534 [5]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks#List_of_assigned_/8_blocks_to_the_United_States_Department_of_Defense https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre... [6] Interestingly, the ASN (27651) that is advertising 7.7.7.0/24 into BGP appears to be registered to a company in Chile -- and they're also advertising 4.4.4.0/24. I would not be surprised to find out that neither of these advertisements are legitimate. [7]: https://en.wikipedia.org/wiki/AMPRNet https://en.wikipedia.org/wiki/AMPRNet

Surprised that he missed out 192.168.0.0/16

signa11 8y ago

why ? these are non routable...

rocqua 8y ago
It is missing from the table of reserved ip addresses. He mentions: 0.0.0.0/8 Local System 10.0.0.0/8 Local LAN 127.0.0.0/8 Loopback 169.254.0.0/16 “Link Local” 172.16.0.0/12 Local LAN 224.0.0.0/4 Multicast 240.0.0.0/4 “Future use”
jlgaddis 8y ago
That was infinity0's point -- there's no reason to scan them.

jlgaddis 8y ago

He also left out a bunch of other networks that one wouldn't really need to scan: 100.64.0.0/10 [0] and 198.18.0.0/15 [1] (and a bunch of /24s [2,3,4] too but, relatively speaking, those are pretty insignificant), although one might find some "interesting" (CGN) stuff in 100.64.0.0/10 if their ISP was making use of it. There are also large portions of the 13 /8s (218 million IPs!) assigned to the US Department of Defense [5] that you wouldn't need to scan since there are no routes to them at all: the 11.0.0.0/8, 22.0.0.0/8, 26.0.0.0/8, 28.0.0.0/8, 29.0.0.0/8, 30.0.0.0/8, and 33.0.0.0/8 networks are, for all intents and purposes, "missing" from the public Internet. Additionally, there are only four /24s in 21.0.0.0/8 that are reachable from the public Internet. Out of the 16,777,216 IP addresses that make up 7.0.0.0/8, only 255 are reachable (7.7.7.0/24) [6]. There's pretty much no point in scanning -- "mapping" -- this address place (unless you are looking specifically for US government/military stuff). ETA: In the interest of time, you probably wanna skip over 44.0.0.0/8 [7] also. [0]: https://tools.ietf.org/html/rfc6598 https://tools.ietf.org/html/rfc6598 [1]: https://tools.ietf.org/html/rfc2544 https://tools.ietf.org/html/rfc2544 [2]: https://tools.ietf.org/html/rfc5737 https://tools.ietf.org/html/rfc5737 [3]: https://tools.ietf.org/html/rfc3068 https://tools.ietf.org/html/rfc3068 [4]: https://tools.ietf.org/html/rfc7534 https://tools.ietf.org/html/rfc7534 [5]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks#List_of_assigned_/8_blocks_to_the_United_States_Department_of_Defense https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre... [6] Interestingly, the ASN (27651) that is advertising 7.7.7.0/24 into BGP appears to be registered to a company in Chile -- and they're also advertising 4.4.4.0/24. I would not be surprised to find out that neither of these advertisements are legitimate. [7]: https://en.wikipedia.org/wiki/AMPRNet https://en.wikipedia.org/wiki/AMPRNet