19 ms·
Amazon owns more than $2B worth of IPv4 addresses
- ThePhysicist 6y agoA small nitpick: They don't "own" these addresses, the regional internet registries (ARIN, RIPE, APNIC etc.) loan them to Amazon so they can use them, they could take them away again if AWS would do something that's against the RIRs' policies. We also have a single /22 block of addresses from RIPE (we were one of the last companies to get such a block in 2019), so far we haven't made use of it though as it's still a bit tricky to find providers that will announce your addresses (without asking a hefty amount of money for it).
- worldofmatthew 6y agoDid you register a ASN?
- ThePhysicist 6y agoNot yet. Getting an ASN number is independent of getting LIR status.
- worldofmatthew 6y agoMore hosts are willing to be a upstream for your ASN than announce your IP block on their ASN.
- bzb6 6y agoThat’s a huge nitpick, given that RIRs generally don’t give a shit even if you don’t use the addresses at all. Also I can imagine Amazon would rightly sue if a RIR tried to take addresses from them.
- deleted 6y ago[deleted]
- CKN23-ARIN 6y agoThe exception to this is a handful of remaining "legacy" pre-RIR address holders. I'm surprised AWS, etc. are so willingly handing the addresses they buy from legacy holders over to ARIN.
- AdamGibbins 6y ago> o far we haven't made use of it though as it's still a bit tricky to find providers that will announce your addresses (without asking a hefty amount of money for it). Vultr can do so https://www.vultr.com/features/bgp/ https://www.vultr.com/features/bgp/ for no additional cost.
- ThePhysicist 6y agoThanks! I'm aware of them, but you need two peers to be able to announce your IP space (multi-homing requirement). AWS actually also allows you to bring your own IPs, so we might indeed go Vultr+AWS for now.
- histriosum 6y agoI dont think the multihoming requirement works like that. Either Vultr or AWS would fulfill it, as they each certainly would be advertising the block out several redundant ISP paths, thus fulfilling the multihoming justification...
- ThePhysicist 6y agoNope, RIPE really requires two different ASNs / peering partners on their ASN application form.
- icedchai 6y agoYou don't need your own ASN to announce IP space. The upstream can do it for you.
- nixgeek 6y agoIt’s only the RIR which requests proof you will multi-home and you must have been able to say to which AS you would peer to get the /22, since it’s a question RIPE asks as standard and the analyst will have considered in approving your application. BGP itself doesn’t care at all. Announce the entire block from one “region” in Vultr, or split it out with a /24 in four different ones. It’ll work just fine.
- stingraycharles 6y agoI’m more surprised that a single IP address is worth $20 apparently than Amazon owning 100 million of them. What I wonder, is it a competitive advantage for Amazon at this point that they have so many? Phrased differently, would it benefit Amazon if the current status quo of IPv4 vs IPv6 adoption is maintained?
- deleted 6y ago[deleted]
- dstick 6y agoYes, I think it would. Because despite the obvious business advantage they have, any would-be competitor would need IPs at a similar scale. That will either cost a ton more than Amazon has, or they simply won’t be available. I own 2048 IPv4’s myself and their value is ever increasing. Like digital real estate, without the fluctuation of crypto. But I would prefer it if IPv6 would take over IPv4, and fast, because it will become a problem that will stifle competitors at some point. If most IPv4’s are owned by big corporations, that’s essentially.. them owning the current internet. IPv6 is practically free. I would love to see a breakdown of IPv4 FAANG ownership!
- toast0 6y agoIt wouldn't take too much to make a breakdown of IP announcements. Ownership is a bit harder to track down, I think. Looking at something like https://bgp.he.net/AS32934#_prefixes https://bgp.he.net/AS32934#_prefixes will tell you what IPs Facebook announces. Rinse and repeat for whoever else. Maybe a bit tricky if you need to track down subsidiary ASes. Disclosure: I worked for WhatsApp including while it was part of Facebook, and was involved in getting AS11917 setup for WhatsApp.
- bonzini 6y agoStupid question: why does WhatsApp need to be its own AS?
- 6y ago
- vlovich123 6y agoI’d be curious how that compares to other cloud providers.
- x86_64Ubuntu 6y agoI've heard Google Cloud doesn't even mess with IPv6, which I find astonishing.
- CKN23-ARIN 6y agoThey're still expanding their IPv4 holdings, and IPv6 support would hamper that.
- Sebguer 6y agoAlmost all of them list their IP ranges. I went and ran the numbers on DO's, available from: http://digitalocean.com/geo/google.csv http://digitalocean.com/geo/google.csv 2,344,576 IPs, so ~47mm on the same math.
- Sebguer 6y agoAnd for Google's from: https://www.gstatic.com/ipranges/cloud.json https://www.gstatic.com/ipranges/cloud.json 7,580,928 So ~151mm, on the same math.
- CountSessine 6y agoWhen they shut down GCP in a couple of years, I wonder what they’ll do with all the addresses?
- jeffbee 6y agoHrmm it's not that much of an error since that is dominated by the /14 and /15 but there's a few /16 that Google uses for itself that aren't in that list. See the DNS TXT records for _netblocks{,2,3}.google.com
- 6y ago
- faeyanpiraat 6y agoDifferent metric: they own ~2.558% of all the available ipv4 addresses.
- seligman99 6y agohttps://github.com/seligman/aws-ip-ranges https://github.com/seligman/aws-ip-ranges Regardless of how you calculate the %, it's doubled in a few years. I still would love to know what they were thinking when they added 252.0.0.0/10 to their list.
- est31 6y agoIs that 252.0.0.0 publicly routed? I can't find an official whois entry, so they just took some reserved address space without asking? It's listed as reserved here: https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml https://www.iana.org/assignments/ipv4-address-space/ipv4-add...
- seligman99 6y agoIt's not routed on the public internet (nor is it listed by AWS as "theirs" anymore, it was on the list for just a little over 24 hours). I got the impression it was meant for some internal to AWS use and was pushed to their list of IP addresses erroneously, but I barely speak to AWS, much less speak for them.
- toast0 6y ago240.0.0.0/4 is formerly known as class E, it's reserved, but I guess you can stomp on it for private networking?
- Sebb767 6y agoThis is 2.5% of the total adress space - not usable, total. It's about the equivalent of 6.25 class A (/8) prefixes. Quite impressive.
- est31 6y agoNothing compared to the US federal government. I count 13 /8 blocks for the DoD, and one for the USPS, so 14 in total. https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
- deleted 6y ago[deleted]
- divbzero 6y agoThe original list of assigned blocks [1] is a fascinating glimpse of history. Some of the Class A networks are still recognizable (MIT, University College London, Stanford) while others have faded in prominence (BBN, CISL, DEC, MITRE, Tymnet). The same 1981 document also contains a list of assigned ports which of course does not include DNS, HTTP(S), IMAP, POP, or SSH. [1]: https://tools.ietf.org/html/rfc790 https://tools.ietf.org/html/rfc790 "RFC 790"
- kseifried 6y agoMITRE is a non profit that "manages federally funded research and development centers (FFRDCs) supporting several U.S. government agencies" they have a technology and cyber security mandate which is still big (they run CVE, CWE, SCAP, etc.). They haven't faded so much as they were never a public/network company in the first place.
- phkahler 6y agoI dont think that's impressive. I think it means something is wrong with governance.
- 6y ago
- deleted 6y ago[deleted]
- anshumankmr 6y agoHow are we not out of IPv4 addresses already? Aren't there a billion phones out there? And probably the same number of PCs and god knows how many servers?
- CKN23-ARIN 6y agoNAT
- Latty 6y agoThere is a lot of NAT going on these days, and a lot of shared addresses. All those devices aren't all online at the same time. As I see it, IPv6 can't come fast enough. NAT really needs to die a death so people can actually use the internet fully, not only as a client or using hack-y work-arounds.
- therealx 6y agoI want ipv6 as much as anyone, but we are not spending enough time preparing for NATs death. It's responsible for far more security than we as a collective would like to admit and there's a lot more we could be doing now to get ready.
- PurpleFoxy 6y agoMost routers I have seen do not leave ipv6 unprotected. By default they block incoming connections like nat would.
- globular-toast 6y agoThat's a common misconception. NAT isn't a security feature but rather a feature of a stateful firewall, which is. There's no reason to remove the firewalls that are in place now when ipv6 happens.
- BlueTemplar 6y agoIf firewalls are even needed, a recent poll on an IPv6 professional forum ended with 50/50 split between opt-in and opt-out for IPv6 firewalls in routers of consumer ISPs...
- hpoe 6y agoFrom what I understand the problem with IPv6 isn't technical problems it is with legacy. According to what I know in Africa and Asia they have mostly already been running on IPv6 the problem is just basically a bunch of lazy network admins in NA and the EU that don't want to learn the new tech and organizations that don't want to switch.
- fakedang 6y agoThis. Ipv6 addresses are very common in Asia and Africa, but I always find ipv4 remnants in Europe.
- klodolph 6y agoWell, yes, legacy. But, > …a bunch of lazy network admins in NA and the EU that don't want to learn the new tech… That’s a cheap shot, and it’s not called for. Network admins are paid to make the networks run. Anything else is less important. If your IPv6 network experiences some small problems, well, you’re going to hold on to IPv4 because small network problems can mean big inefficiencies or lost sales. Just a few weeks ago I was on the phone with my WiFi router’s vendor for a couple hours or more because IPv6 traffic wasn’t working through it. I had narrowed the problem down to the router itself. It’s not necessarily that IPv6 is poorly tested or has technical problems, it’s that there’s a long tail of devices/configurations/software out there which screw it up, and it’s often cheaper to just use IPv4 rather than suffer even the minor inconveniences and troubleshooting sessions necessary to run IPv6. It’s moving forward but it’s slow progress, and it’s not because network admins are lazy or stupid. It’s because there’s a lot of work to be done and not everyone has much of an incentive to do it at all.
- spicyramen 6y agoAgree. Moving IP addresses to IpV6 at any organization required huge planning and is normally not a business or competitive advantage. (In most cases)
- velvetz 6y agoDefinitely. At our company our network provider decided that it's better for us to use ipv6 from now on. For one day the customer support couldn't figure out what was wrong with our network. They even suggested that the recent heavy rain might have damaged the lines. Finally after a few struggles they mentioned in one sentence that they switched our region to ipv6 only, and that was when we, the customer, realized what's wrong. And obviously, we have a business plan. So that was one day of work without any internet.
- renewiltord 6y agoDoes anyone sell a /30 or smaller block?
- matsur 6y ago/24 is the smallest block you can advertise on the Internet.
- obilgic 6y agoImpressive, however just like the stock market, if you try to dump all those, It won't worth anything close to $2B.
- jstanley 6y agoRight, and if you try to buy them all, it will cost a lot more than $2B.
- obilgic 6y agoYes and no. > "try to buy them all" buy all of AWS's? Then: no, it would cost less. buy from open market? Then: yes, It would cost more
- nucleardog 6y agoI would expect it would cost more from AWS. They're not just holding them unused like a lot of organizations, they're necessary for them to continue making their $35b+ per year from AWS.
- jstanley 6y agoIt works the same both ways. If you go into a market and try to buy lots of something, it drives the price up because you're increasing demand and removing supply. If you go into a market and try to sell lots of something, it drives the price down because you're increasing supply and removing demand. AWS don't obviously have an incentive to sell IP addresses for substantially below market value, so I don't see why buying them from AWS versus someone else would make much difference.
- obilgic 6y ago> AWS don't obviously have an incentive to sell ... You just invalided yourself. What do you think my point is?
- 6y ago
- tanilama 6y ago2B is not a big deal for Amazon or AWS
- alex_young 6y agoYour ISP doesn’t want real IPv6. It’s bad for business.
- enz 6y agoI don't see why. Major consumer-grade French ISPs give IPv6 by default on FTTH installations and the router is configured accordingly (Orange, Free, SFR, Bouygues Telecom). Generally, you get a /64. Of course, when using IPv6 there is no NATting, each of your device has its own IPv6 address of the /64 range allocated to you.
- BlueTemplar 6y agoAnd yet they are still not doing it properly: they are supposed to be giving at least /48 for businesses and /56 for customers: https://www.ripe.net/publications/docs/ripe-690 https://www.ripe.net/publications/docs/ripe-690
- alex_young 6y agoThe addressing is exactly why IPv6 isn’t something most ISPs want you to have in your house. Right now blocking a bunch of home servers is easy - just don’t give people addresses. With IPv6 you’ll need to thread that needle some other way or give people access to something that will actually test your advertised bandwidth commitments. Edit: instead of downvoting how about having a conversation? That’s the great thing about this place, lots of diverse perspectives.
- pdkl95 6y ago$ wget https://ip-ranges.amazonaws.com/ip-ranges.json $ grep ip_prefix ip-ranges.json | sed -re 's|.*(/[0-9]+).*|\1|' | sort | uniq -c 4 /11 16 /12 30 /13 82 /14 188 /15 278 /16 70 /17 63 /18 30 /19 47 /20 111 /21 248 /22 204 /23 839 /24 68 /25 235 /26 142 /27 124 /28 50 /29 42 /30 362 /31 370 /32
- opsunit 6y agoI have a tool that makes parsing that file easier for some query types: https://github.com/sampointer/digaws https://github.com/sampointer/digaws
- throw0101a 6y agoYou may be interested in jq: > jq is like sed for JSON data - you can use it to slice and filter and map and transform structured data with the same ease that sed, awk, grep and friends let you play with text. * https://stedolan.github.io/jq/ https://stedolan.github.io/jq/
- npteljes 6y agoI love jq. The simple usecase of piping a json to "jq .", having it pretty-printed is awesome in itself.
- geek_at 6y agoalso someone tell them about curl
- throw0101a 6y agoI default to wget because as a sysadmin I usually want to download a file, and that is the default behaviour. Perhaps devs default to curl because they want to pipe things.
- tempest_ 6y agoWith jq and curl curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq '.prefixes | .[].ip_prefix | .[-3:]' | sort | uniq -c
- TechBro8615 6y agoI used to own 10k IP addresses that I sold as proxy servers to internet marketers. I made about $20k a month and it paid my bills through college. I had no idea what I was doing and eventually shut down the company, but damn, I wish I at least kept control of those things. If you want to see some sketchy shit, look deeply into what the VPN companies are doing.
- mepkn 6y agoI wish I had the same idea.
- TechBro8615 6y agoYou could probably still do it and do fairly well. Go on BlackHatWorld as a starting point. I did this circa 2011-2013, but really all I did was arbitrage between webhostingtalk and BHW/Wickedfire. I ran a bunch of squidproxy instances and let the server providers convince me that I couldn’t have more than 256 IPs per server, so I way overpaid.
- sam1r 6y agoSpoken like a true tech bro.
- xacky 6y agoIt’s the same mindset with Bitcoin, Tech Stocks or even Pokemon cards. It became valuble because not many people knew.
- aritmo 6y agoWhat are they doing?
- TechBro8615 6y agoI think there was a lawsuit against one of them recently. But the gist of it is they’re opening a bunch of LLCs and registering their IPs with ARIN. When you “geolocate” an IP, you’re really just looking up the registered info for that IP’s ASN in the ARIN/RIPE database.
- SteveGregory 6y agoAt this point, it’s the same as RF spectrum. Yet clearly there is no regulatory body to manage it.
- Scoundreller 6y agoIt’s okay. When it comes to RF, most regulatory bodies are content to let buyers camp on their allocations just to keep out any competition. While the auction receipts go into the public coffers, it’s not like we get annual cheques.
- CKN23-ARIN 6y agoThere are five regulatory bodies managing it. Six, if you count IANA. https://www.icann.org/resources/pages/allocation-ipv4-rirs-2012-02-25-en https://www.icann.org/resources/pages/allocation-ipv4-rirs-2... https://afrinic.net/policy/manual https://afrinic.net/policy/manual https://www.arin.net/participate/policy/nrpm/ https://www.arin.net/participate/policy/nrpm/ https://www.apnic.net/community/policy/ https://www.apnic.net/community/policy/ https://www.lacnic.net/1033/2/lacnic/policies https://www.lacnic.net/1033/2/lacnic/policies https://www.ripe.net/publications/docs/ripe-policies https://www.ripe.net/publications/docs/ripe-policies
- Blikkentrekker 6y agoSo do they actually use these addresses for something or are they simply stockpiling them? Some jurisdictions have laws regarding real estate that, if it not be used for about a decade, it becomes legal to squat. This is primarily in densely populated jurisdictions where real estate is a scarcity and the government doesn't want it to go unused. A similar structure could actually be made for IPv4 addresses.
- wmf 6y agoStockpiling IP addresses is already forbidden (although not really enforced). AWS is using these addresses for EC2 VMs.
- Blikkentrekker 6y agoForbidden where? I.P. addresses, unlike real estate, are a matter that's hard to bind to any specific jurisdiction.
- wmf 6y agoPutting legacy aside, all IP addresses are under the governance of a RIR and all RIRs require IP holdings to be justified by usage.
- enz 6y agoLet's use IPv6 more and it'll worth far less than $2B.
- i_like_to_post 6y agoThe problem with IPv6 is that it's a fundamentally flawed design. Which looks easier to input / dictate over the phone / write down somewhere? 220.12.30.01 or 2001:cdba:0000:0000:0000:0000:3257:9652?
- bawolff 6y agoThe DNS name sounds easier to say over the phone...
- kortilla 6y agoUse DNS, that’s what it’s there for. MAC addresses aren’t referred to as fundamentally flawed and they are approximately the same length as the shorted version of the address you posted.
- mindslight 6y agoForget DNS. Use an overlay with content routing. Hierarchies suck. It's extremely hyperbolic to call an ugly syntax a bad "design". But IMO it would have been much nicer if they just reused '.' as in IPv4. ':' seemingly came out of their pie in the sky desire to replace MACs. Speaking of MACs, every time every time I see some cheap trash gizmo come with its own MAC I'm surprised there isn't address space pressure. I guess that's due to having 16 more bits as well as being non-aggregable.
- kortilla 6y agoYeah, that extra 16 bits is a game changer. The whole v6 debacle wouldn’t have happened if v4 was 48 bits. It’s funny, there is an interview with Vint Cerf where he mentions the choice of 32 bit address space for ipv4 was essentially pulled out of a hat and it could just as easily have been 48/64/24.
- daper 6y agoFor web serving it's possible to have IPv6-only server accessible to anyone. Just use Cloudflare. I'm not sure it's documented but I started using IPv6-only origin server behind Cloudflare and it seems to work OK for people connecting both IPv4 and IPv6. The client IP is in CF-Connecting-IP, even for IPv4 connections. For me it just works.
- perlgeek 6y agoThat's a competitive advantage they have, which dis-incentivizes them from pushing IPv6 adoption.
- nvarsj 6y agoIndeed. It's probably why they've been so slow to support IPv6 across their various services. I still don't think you can have a pure IPv6 network yet on a VPC.
- johnjungles 6y agoIPv4 is the next Bitcoin ;)
- albertshin 6y agoIn what sense?
- jlvdh 6y agoWhy do ipv4 addresses still hold so much value? Isn’t there an abundance of ipv6 available already?
- blueblisters 6y agoWhat are the reasons for slow IPv6 adoption a whole two decades after notification by IETF? I am assuming the demand for IPv4 address blocks is mainly driven by backwards compatibility requirements.
- marcan_42 6y agoLazy ISPs. Servers won't go IPv6-only until most users have IPv6. This it's on providers to take the initiative to deploy IPv6. Some have. Some have not. For example, approximately nobody has IPv6 in Spain. It's one of the countries furthest behind in dual-stack adoption. This is entirely the fault of Spanish ISPs. ISPs won't be forced to deploy dual stack IPv6 until IPv6 only servers are commonplace, and IPv6 only servers won't exist until that wouldn't lose them a significant fraction of users. And thus progress is glacial.
- nerdponx 6y agoThis. I have Comcast Xfinity in the USA (local monopoly, I would use a different ISP if I could) and they just don't offer IPv6. The rep on the phone seemed surprised that I would even ask.
- mdaniel 6y agoSurely you mean static IPv6, because of the 3 different cities I've been forced to use Xfinity (even on their lowest plan Internet), I have been given IPv6 leases and I for sure didn't call anyone Or, another certainly plausible explanation is that your router either doesn't support IPv6 or it is disabled
- nerdponx 6y agoI asked when I was setting up service. I can try to enable it in my router and see if I get an IPv6 address.
- aboringusername 6y agoI suspect tracking and analytics are also part of the problem. Imagine every single IPv4 IP ban now being rendered entirely and utterly useless. DRM/Geolocation blocks are also common and IP's are used quite widely in many software systems, most are likely to only accept a v4 address/format (perhaps terrible regex too). Detectives and other governments rely on IPv4 addresses as part of 'evidence', and storing V6 uses more storage and is much more complicated generally due to the much longer address space. We won't see the internet migrate to IPv6 entirely for another 20/30 years from now.
- drmpeg 6y agoThere seems to be a lot of double counting in that list. For example, 44.192.0.0/11 and 44.224.0.0/11 are listed twice. Then there are 28 entries of 44.x.x.x that would fall under the two /11's already listed.
- ghaff 6y agoAbout 8 million of those, a bit under 10%, came from MIT selling half of their /8 to Amazon. They sure accumulated a bunch of others though.
- WaitWaitWha 6y agolarge majority of cheap networked electronics only can do IPv4.
- variable11 6y agoSo a fraction of their unpaid taxes? Seize it under eminent domain.
- brassattax 6y agoI assume the $2B valuation is precisely because of services like AWS needing so many
- austincheney 6y agoWhat, besides DNS, is preventing the migration to IPv6? Is it old technology still in use? My house is completely IPv6 and not intentionally so.
- benjohnson 6y agoFor myself, IPv6 address are just to annoying to deal with as a human. It's as much of a mental shift as replacing street addresses with Latitude/Longitude coordinates. So I've avoided IPv6 as much as possible.
- StartupTree 6y agoI feel the same. Nice analogy, going to use it.
- ancarda 6y agoTo extend this analogy a bit... wouldn't 'street addresses' be DNS and lat/long coordinates be IP addresses? Can you elaborate a bit? Where do you find frustration with IPv6? I've been using IPv6 for probably close to 10 years now, and I can't say it's been frustrating
- _rs 6y agoAs someone who thinks they are pretty savvy with "network stuff", I find the whole thing daunting. But my ISP also doesn't support IPv6 yet either, so I have no easy way (or need) to experiment with it yet.
- ancarda 6y agoYears ago I used to have an IPv6 tunnel provided by SixXS. That let me get my feet wet by moving to v6 capable hosting and being able to send traffic to my website over the SixXS tunnel. At this point, though, you may be able to find an IPv6 capable ISP and just switch to them. Your phone might also have IPv6 too, especially if it's 4G/LTE. Any amount of exposure is better than none. If you're using AWS, I can help you setup IPv6 in your VPC and use it with EC2 which can let you get some first hand experience. My email is in my profile if you want to take me up on that offer.
- rajnathani 6y agoPrevious discussion (two months ago): https://news.ycombinator.com/item?id=24839887 https://news.ycombinator.com/item?id=24839887
- NorwegianDude 6y agoSince when does IPv4-addresses cost money? I'm pretty sure IPs are allocated for free if available and you have a use case for them? I know RIPE now want members to charge customers for IPs, but..
- welterde 6y agoEver since the big RIRs (like RIPE) have run out of IPv4 addresses to allocate - which was a couple years ago (ARIN was out 2015; and RIPE ran out end of last year - and that was already with quite restrictive allocation policies).
- NorwegianDude 6y agoI got a hold of a few addresses for free last year, but this year it was clear that RIPE wanted members to charge for IPs. I see that RIPE is currently only giving out a /24 for free to those who haven't received an allocation before, so my bad.
- welterde 6y agoEven before the end of last year it was limited to exactly one last /22 per LIR for a few years already. The pool that was set aside for that last allocation was depleted at the end of last year. Now they are limited to handing out /24's that are returned to them to hand out to new ISPs (since going IPv6-only is still not quite possible..).