7 ms·

They don't have to give it back, of course. If anything, the first organization to have netblocks yanked out from under them should be the US DoD. As I mention

They don't have to give it back, of course. If anything, the first organization to have netblocks yanked out from under them should be the US DoD. As I mentioned a few days ago [0]: > There are also large portions of the 13 /8s (218 million IPs!) assigned to the US Department of Defense [5] that you wouldn't need to scan since there are no routes to them at all: the 11.0.0.0/8, 22.0.0.0/8, 26.0.0.0/8, 28.0.0.0/8, 29.0.0.0/8, 30.0.0.0/8, and 33.0.0.0/8 networks are, for all intents and purposes, "missing" from the public Internet. > Additionally, there are only four /24s in 21.0.0.0/8 that are reachable from the public Internet. Out of the 16,777,216 IP addresses that make up 7.0.0.0/8, only 255 are reachable (7.7.7.0/24) [6]. Just because we can't "see" them or get to them doesn't mean they aren't using them, though. Yes, it sucks that we're out of IPv4 addresses but we've known this was coming for, what, 20+ years? The quicker we all get moved over to IPv6, the quicker we can forget about it. (Disclosure: I've had a static IP from 44/8 for ~25 years and I don't wanna give it back.) [0]: https://news.ycombinator.com/item?id=16893669 https://news.ycombinator.com/item?id=16893669

freehunter 9y ago
Man I've worked with my fair share of quasi-governmental agencies who have a /8 or /16 to themselves and use it for their internal address space. I wonder how many addresses we'd have if we could take back unused address space.
- ancarda 9y ago
  Why do they do that? They already have an /8 to themselves -- 10.0.0.0/8. Did they need an additional 16M IP addresses?
  - maccam94 9y ago
    There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other machine (firewall willing). Until one day, IP exhaustion attacked. Thankfully NAT doesn't exist in IPv6, because 2^128 addresses should be enough for everybody.
    - cortesoft 9y ago
      Everything having a publicly routable IP isn't an automatic good thing.
      - throwaway2048 9y ago
        NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.
        dfox 9y ago
        Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.
        pas 9y ago
        Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)
        oasisbob 9y ago
        I think the most productive way to look at it that for NAT/NAPT/cone NAT to work, a necessary prerequisite is a default-deny inbound firewall policy and stateful connection tracking. Once you have that, layering on NAT is possible. But the security implications were already addressed before you get to that point.
        zAy0LfpBZLC8mAC 9y ago
        A NAT doesn't drop anything. A NAT translates. A firewall drops. If you only have a NAT, your ISP (or anyone who has compromised their router, or possibly simply your neighbour when ISPs occasionally fail to isolate their customers on layer 2) still can send you packets addressed directly to your "internal" addresses. The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. NAT and "internal addresses" is as much a security mechanism as not telling anyone that there is a room called "living room" in your house. If you want to prevent strangers from getting into your living room, you don't use internal names for your rooms, you install a lock on the door.
  - jlgaddis 9y ago
    Well, see, compared to what most of us are used to nowadays, IP networking looked a little bit different back then. In 1981, RFC791 [0] came about, describing a way of doing IP addressing on the ARPANET (based upon "classful networks" [1]). In accordance with this scheme, you would get either a /8 ("Class A"), a /16 ("Class B"), or a /24 ("Class C") -- depending on how many hosts you had (or thought you might reasonably have). This is the main reason why you see some organizations with a /8 today that you wouldn't expect. Classless routing ("CIDR") [2] -- or, more specifically, variable length subnet masking (VLSM), what we're all familiar with today -- didn't officially exist until RFC1518 [3] and RFC1519 [4] (fall 1993). CIDR was introduced as a solution to a problem people were already starting to experience then: a shortage of IPv4 addresses! (Yes, 25 years ago, they realized they were running out of IPv4 addresses and started working on solutions. IPv6 [5] first emerged as a "draft standard" in late 1998 -- but only officially became an "Internet standard" last summer!) [0]: https://tools.ietf.org/html/rfc791 https://tools.ietf.org/html/rfc791 [1]: https://en.wikipedia.org/wiki/Classful_network https://en.wikipedia.org/wiki/Classful_network [2]: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing [3]: https://tools.ietf.org/html/rfc1518 https://tools.ietf.org/html/rfc1518 [4]: https://tools.ietf.org/html/rfc1519 https://tools.ietf.org/html/rfc1519 [5]: https://tools.ietf.org/html/rfc8200 https://tools.ietf.org/html/rfc8200
    - pas 9y ago
      How come IPv6 wasn't standardized before 2017? I suspect there's some kind of story there. Do you happen to know the details? Any links/pointers? Thanks!
      - zAy0LfpBZLC8mAC 9y ago
        It's just nonsense. In the IETF's nomenclature, the label "Internet Standard" is used to refer to, and I quote: A specification for which significant implementation and successful operational experience has been obtained may be elevated to the Internet Standard level. An Internet Standard (which may simply be referred to as a Standard) is characterized by a high degree of technical maturity and by a generally held belief that the specified protocol or service provides significant benefit to the Internet community. A specification that reaches the status of Standard is assigned a number in the STD series while retaining its RFC number. See also https://tools.ietf.org/html/rfc2026#section-4.1.3 https://tools.ietf.org/html/rfc2026#section-4.1.3 Most internet standards are not "Internet Standard"s, as can be seen by the fact that IPv6 got assigned the standard number 86, and up until last year, IPv6 wasn't either, but it still was a perfectly fine and well-documented standard, and has been for a long time.
  - gwright 9y ago
    Using NAT and the IPv4 private address ranges sounds at first like a good solution but it creates some operational problems when two organizations want to connect their networks or when two organizations merge.
leeter 9y ago
Technically that depends on the agreements with IANA. If IANA could say "HEY YOU if you're not using 80% of your space actively, by January after next then we'll charge you a an exponentially increasing fee" I suspect they'd get a lot more movement. I suspect that the price of IP space on the market will also change that attitude as people go "Well crap that's worth a lot of money"
- craftyguy 9y ago
  What if they didn't pay it? It's the US military, IANA would have a hard time enforcing any punishment they bestowed on the DoD.
  - leeter 9y ago
    Then they reverse the assignment, as the ultimate authority on the internet they do have the right.
    - craftyguy 9y ago
      "Something something National Security"
      - AstralStorm 9y ago
        Since they are not publicly used, these sound like bait for routing redirection attacks. It is a security issue for everyone involved.
  - astrodust 9y ago
    If the US military had to pay a staggering $100/IP per year it wouldn't even show up in a detailed audit. It's an utterly inconsequential amount compared to the military budget. It's not a price thing, it's a "why should we" thing.
0care 9y ago
I bet DoD thinks that they sure were nice to only retain 13 /8s.

freehunter 9y ago

Man I've worked with my fair share of quasi-governmental agencies who have a /8 or /16 to themselves and use it for their internal address space. I wonder how many addresses we'd have if we could take back unused address space.

ancarda 9y ago
Why do they do that? They already have an /8 to themselves -- 10.0.0.0/8. Did they need an additional 16M IP addresses?
- maccam94 9y ago
  There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other machine (firewall willing). Until one day, IP exhaustion attacked. Thankfully NAT doesn't exist in IPv6, because 2^128 addresses should be enough for everybody.
  - cortesoft 9y ago
    Everything having a publicly routable IP isn't an automatic good thing.
    - throwaway2048 9y ago
      NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.
      - dfox 9y ago
        Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.
        pas 9y ago
        Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)
        oasisbob 9y ago
        I think the most productive way to look at it that for NAT/NAPT/cone NAT to work, a necessary prerequisite is a default-deny inbound firewall policy and stateful connection tracking. Once you have that, layering on NAT is possible. But the security implications were already addressed before you get to that point.
        zAy0LfpBZLC8mAC 9y ago
        A NAT doesn't drop anything. A NAT translates. A firewall drops. If you only have a NAT, your ISP (or anyone who has compromised their router, or possibly simply your neighbour when ISPs occasionally fail to isolate their customers on layer 2) still can send you packets addressed directly to your "internal" addresses. The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise. NAT and "internal addresses" is as much a security mechanism as not telling anyone that there is a room called "living room" in your house. If you want to prevent strangers from getting into your living room, you don't use internal names for your rooms, you install a lock on the door.
- jlgaddis 9y ago
  Well, see, compared to what most of us are used to nowadays, IP networking looked a little bit different back then. In 1981, RFC791 [0] came about, describing a way of doing IP addressing on the ARPANET (based upon "classful networks" [1]). In accordance with this scheme, you would get either a /8 ("Class A"), a /16 ("Class B"), or a /24 ("Class C") -- depending on how many hosts you had (or thought you might reasonably have). This is the main reason why you see some organizations with a /8 today that you wouldn't expect. Classless routing ("CIDR") [2] -- or, more specifically, variable length subnet masking (VLSM), what we're all familiar with today -- didn't officially exist until RFC1518 [3] and RFC1519 [4] (fall 1993). CIDR was introduced as a solution to a problem people were already starting to experience then: a shortage of IPv4 addresses! (Yes, 25 years ago, they realized they were running out of IPv4 addresses and started working on solutions. IPv6 [5] first emerged as a "draft standard" in late 1998 -- but only officially became an "Internet standard" last summer!) [0]: https://tools.ietf.org/html/rfc791 https://tools.ietf.org/html/rfc791 [1]: https://en.wikipedia.org/wiki/Classful_network https://en.wikipedia.org/wiki/Classful_network [2]: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing [3]: https://tools.ietf.org/html/rfc1518 https://tools.ietf.org/html/rfc1518 [4]: https://tools.ietf.org/html/rfc1519 https://tools.ietf.org/html/rfc1519 [5]: https://tools.ietf.org/html/rfc8200 https://tools.ietf.org/html/rfc8200
  - pas 9y ago
    How come IPv6 wasn't standardized before 2017? I suspect there's some kind of story there. Do you happen to know the details? Any links/pointers? Thanks!
    - zAy0LfpBZLC8mAC 9y ago
      It's just nonsense. In the IETF's nomenclature, the label "Internet Standard" is used to refer to, and I quote: A specification for which significant implementation and successful operational experience has been obtained may be elevated to the Internet Standard level. An Internet Standard (which may simply be referred to as a Standard) is characterized by a high degree of technical maturity and by a generally held belief that the specified protocol or service provides significant benefit to the Internet community. A specification that reaches the status of Standard is assigned a number in the STD series while retaining its RFC number. See also https://tools.ietf.org/html/rfc2026#section-4.1.3 https://tools.ietf.org/html/rfc2026#section-4.1.3 Most internet standards are not "Internet Standard"s, as can be seen by the fact that IPv6 got assigned the standard number 86, and up until last year, IPv6 wasn't either, but it still was a perfectly fine and well-documented standard, and has been for a long time.
- gwright 9y ago
  Using NAT and the IPv4 private address ranges sounds at first like a good solution but it creates some operational problems when two organizations want to connect their networks or when two organizations merge.

leeter 9y ago

Technically that depends on the agreements with IANA. If IANA could say "HEY YOU if you're not using 80% of your space actively, by January after next then we'll charge you a an exponentially increasing fee" I suspect they'd get a lot more movement. I suspect that the price of IP space on the market will also change that attitude as people go "Well crap that's worth a lot of money"

craftyguy 9y ago
What if they didn't pay it? It's the US military, IANA would have a hard time enforcing any punishment they bestowed on the DoD.
- leeter 9y ago
  Then they reverse the assignment, as the ultimate authority on the internet they do have the right.
  - craftyguy 9y ago
    "Something something National Security"
    - AstralStorm 9y ago
      Since they are not publicly used, these sound like bait for routing redirection attacks. It is a security issue for everyone involved.
- astrodust 9y ago
  If the US military had to pay a staggering $100/IP per year it wouldn't even show up in a detailed audit. It's an utterly inconsequential amount compared to the military budget. It's not a price thing, it's a "why should we" thing.

0care 9y ago

I bet DoD thinks that they sure were nice to only retain 13 /8s.