7 ms·

I've often wondered how much of the IPv4 address space is legacy allocations that are not at all being fully utilized. Perhaps the market for IPv4 addresses has

I've often wondered how much of the IPv4 address space is legacy allocations that are not at all being fully utilized. Perhaps the market for IPv4 addresses has worked this out, and anyone that has such an allocation has cashed in.

icedchai 7y ago
There are tons of legacy allocations from the 90's and earlier than are not being routed / utilized. Many are also assigned to defunct entities. To confirm this, you can poke around WHOIS a little bit. Because many of them actually predate ARIN's formation in 1997, they are considered "legacy" allocations and aren't charged a fee by ARIN unless the organization has opted into an agreement.
toast0 7y ago
The IPs in question were directly assigned to the defendant by ARIN based on fraudulent requests. They weren't fraudulently transferred from existing allocations.
- jonawesomegreen 7y ago
  Thank you. I misread the article. I edited my post to take out the incorrect part.
brianwawok 7y ago
For enough dollars you can sample 100k address at random and have a decent guess? Not everyone responds to a ping but I suspect most do
- freedomben 7y ago
  ICMP is blocked by default now in many firewall setups, so unless the admin specifically allows ICMP the packets will likely be dropped. Also, be careful as "host discovery" can be viewed as a type of "hacking" depending on who you are and who is watching/judging you.
  - gjs278 7y ago
    nobody has ever gone to jail for using the ping tool
  - GordonS 7y ago
    Your first point is definitely correct. Your second point though... really? Do you have any sources for anyone, anywhere being charged for using ping?
    - freedomben 7y ago
      No, I haven't heard of anyone being criminally charged for ping, but I have known someone whose ISP cut them off and he had to go through an onerous process to get service restored. I've also heard of people that use EC2 instances and get their AWS account terminated.
      - metildaa 7y ago
        AWS is also overzealous about DMCA notices. If you go to other providers like Scaleway, they'll forward any abuse complaints but you don't have to do anything about them.
        freedomben 7y ago
        Hadn't heard of Scaleway before, but their prices look very reasonable! Are you a customer of theirs? Any issues with reliability?
        metildaa 7y ago
        I don't use Scaleway or Online.net, as they're known for ignoring abuse reports. Other hosts like OVH tend to forward abuse reports and deal with repeat offenders, a good middle ground between AWS's draconian policies and Scaleway's.
    - LilBytes 7y ago
      With regards to the second point, definitely. Quite a few years ago the security team of the organisation I worked at didn't have our internal vulnerability scanning services automated. It relied on them capturing the IPv4 addresses (specifically the /32's, not the subnets) and manually entering them into the engine. Our security team mistyped a handful of these addresses and instead of the scan running across our internal infrastructure, we scanned WalMarts external facing infrastructure in the US from Australia. These scans were happening semi-regularly for a period of a few weeks before we received a cease and desist and the sec. team realised their error. I'm still rather surprised more didn't come of it.
- toast0 7y ago
  For 0 dollars, you can get a BGP table dump and see how many addresses aren't even routable. (doesn't mean they're not in use, but makes it less likely)
broknbottle 7y ago
Here's one, it's under S-MOS Systems, Inc. (SMOSSY) which was bought by Epson the printer company. Somebody registered the domain when it expired and sold the company + "IPs" to a company I worked at in the Noc. When we went to ARIN to set everything up for rDNS, ARIN pushed back and said you do not own these, Epson own's this range. The company that sold the IPs disappeared with the money. The smos.com registration lapsed and some chinese company immediately registered the domain. 148.130.0.0/16

icedchai 7y ago

There are tons of legacy allocations from the 90's and earlier than are not being routed / utilized. Many are also assigned to defunct entities. To confirm this, you can poke around WHOIS a little bit. Because many of them actually predate ARIN's formation in 1997, they are considered "legacy" allocations and aren't charged a fee by ARIN unless the organization has opted into an agreement.

toast0 7y ago

The IPs in question were directly assigned to the defendant by ARIN based on fraudulent requests. They weren't fraudulently transferred from existing allocations.

jonawesomegreen 7y ago
Thank you. I misread the article. I edited my post to take out the incorrect part.

brianwawok 7y ago

For enough dollars you can sample 100k address at random and have a decent guess? Not everyone responds to a ping but I suspect most do

freedomben 7y ago
ICMP is blocked by default now in many firewall setups, so unless the admin specifically allows ICMP the packets will likely be dropped. Also, be careful as "host discovery" can be viewed as a type of "hacking" depending on who you are and who is watching/judging you.
- gjs278 7y ago
  nobody has ever gone to jail for using the ping tool
- GordonS 7y ago
  Your first point is definitely correct. Your second point though... really? Do you have any sources for anyone, anywhere being charged for using ping?
  - freedomben 7y ago
    No, I haven't heard of anyone being criminally charged for ping, but I have known someone whose ISP cut them off and he had to go through an onerous process to get service restored. I've also heard of people that use EC2 instances and get their AWS account terminated.
    - metildaa 7y ago
      AWS is also overzealous about DMCA notices. If you go to other providers like Scaleway, they'll forward any abuse complaints but you don't have to do anything about them.
      - freedomben 7y ago
        Hadn't heard of Scaleway before, but their prices look very reasonable! Are you a customer of theirs? Any issues with reliability?
        metildaa 7y ago
        I don't use Scaleway or Online.net, as they're known for ignoring abuse reports. Other hosts like OVH tend to forward abuse reports and deal with repeat offenders, a good middle ground between AWS's draconian policies and Scaleway's.
  - LilBytes 7y ago
    With regards to the second point, definitely. Quite a few years ago the security team of the organisation I worked at didn't have our internal vulnerability scanning services automated. It relied on them capturing the IPv4 addresses (specifically the /32's, not the subnets) and manually entering them into the engine. Our security team mistyped a handful of these addresses and instead of the scan running across our internal infrastructure, we scanned WalMarts external facing infrastructure in the US from Australia. These scans were happening semi-regularly for a period of a few weeks before we received a cease and desist and the sec. team realised their error. I'm still rather surprised more didn't come of it.
toast0 7y ago
For 0 dollars, you can get a BGP table dump and see how many addresses aren't even routable. (doesn't mean they're not in use, but makes it less likely)

broknbottle 7y ago

Here's one, it's under S-MOS Systems, Inc. (SMOSSY) which was bought by Epson the printer company. Somebody registered the domain when it expired and sold the company + "IPs" to a company I worked at in the Noc. When we went to ARIN to set everything up for rDNS, ARIN pushed back and said you do not own these, Epson own's this range. The company that sold the IPs disappeared with the money. The smos.com registration lapsed and some chinese company immediately registered the domain. 148.130.0.0/16