14 ms·
Amazon, Verizon found using IPv4 240/4 addresses
- tedunangst 4y agoThis seems like a rather long post for the equivalent of "haha, I can see your underpants." What's the real significance to this vs seeing 10/8 show up in a traceroute?
- JonathonW 4y agoIf you're using addresses in the 240/4 block, you're going to run into issues when/if those addresses are assigned for public use. It's not necessarily a problem for the general public, but will pose a routing problem for those using them internally.
- tedunangst 4y agoPeople have been privately squatting on public networks like 11/8 since forever. It's a problem for them, maybe, and a mild curiosity for the rest of us. I'm just saying "we saw 240 in a traceroute" could have been a tweet, not a research paper. I kept scrolling and scrolling trying to find out why it wasn't a tweet.
- themoonisachees 4y agoOne of our clients used to have a sysadmin with a knack for 192.169/16. Haven't had any problems yet but its bound to happen eventually.
- pclmulqdq 4y agoI personally love IP addresses in the 172.16/12 range. I have my house in that range, and I can VPN in from anywhere and never have any IP address conflicts. EDIT: I just realized you said 192.169/16, which is definitely not available for private IPs.
- treesknees 4y agoI talked to someone who had to re-ip his home network because he was using a subnet of 10./8 that conflicted with his VPN/work access. It's still possible to conflict with a local network you're on, it's not that nobody ever uses a 172.16/12 block. A company I worked for, which is basically a group of a dozen acquisitions, uses practically every RFC1918 block which makes things really annoying. 10./8 used by IT, 192.168/16 used by company X acquired in 2004, 172.17/16 used by company Y acquired in 2011. The list of routes the VPN software installed was impressive.
- pclmulqdq 4y agoI think if I were VPNing from a campus or an office, things would be different. Hotels, coffee shops, and corporate guest networks all seem to either like 10/8 or 192.168/16. By the way, I use 172.30/16 for my home net. I have personally seen use of 172.16/16 and 172.31/16 before.
- andrewf 4y agoI work for a place that legitimately has 192.16.64.0/21, it's caused occasional confusion when folks aren't looking really closely.
- akdor1154 4y agoThat addr rings a bell.. Is it owned by github by any chance?
- Runways 4y agoHey... I have an address in that block... >:[
- jvolkman 4y agoAmazon was definitely using 11/8 internally when I was there 7 years ago.
- zyx321 4y agoVPN services[1] seem to love assigning non-compliant addresses like 5/8 or 100/8 for their internal networks. [1] and I mean 'real' VPN that connect machines you own, not glorified proxies/exit nodes.
- grogers 4y agoThese are being used as link addresses, they probably aren't even routable within Amazon's network. They probably want the link addresses to be globally unique so it simplifies management or so traceroute reverse lookup is easier (e.g. to pinpoint traffic loss). They probably ran out of the other RFC3330 usual suspects or something. I wouldn't read too much into it. If they are using it in a way that will break if 240/8 is assigned, I'm sure they will fix it quickly.
- yjftsjthsd-h 4y agoWhy wouldn't they use IPv6 for that? Compatibility issues?
- stormbrew 4y agoI think the thing is that if you actually need only 24ish bits worth of addresses for something and it doesn't need to be routable, ipv6 just adds a lot of baseline complexity ipv4 doesn't have unless you go out of your way. Ipv6 isn't just an address extension, it's a whole ass architecture unto itself.
- wmf 4y agoYeah, I don't know how many routers support RFC 5549 and it never seemed to become a best practice.
- Melatonic 4y agoTell that to China who internally are apparently using all kinds of unusable addresses due to the The Great Firewall!
- yyyk 4y agoThe current IETF notion seems to be that any decision on 240/4 will hinder IPv6 adoption, they are very unlikely to do anything with it. This ironically means 240/4 ends up de facto private... * See https://news.ycombinator.com/item?id=29246420 https://news.ycombinator.com/item?id=29246420 for a discussion of a related proposal.
- MrStonedOne 4y ago
- gnfargbl 4y agoThe article discusses a 2007 proposal [1] for 240/4 to be used as a private address space -- essentially a bigger, alternative to 10/8 -- and then goes on to imply/state that the proposal failed as it was felt that adding further sticking plasters to IPv4 was somehow undermining IPv6 adoption. The point of the article seems to be to show that in reality, 240/4 is being used as a private address space despite not being officially sanctioned as such. As I think you're pointing out, that's not necessarily interesting because if 240/4 were officially sanctioned as private space, then these people would likely not want to use it, for the same reasons that they aren't already using 10/8. [1] https://datatracker.ietf.org/doc/html/draft-wilson-class-e-00 https://datatracker.ietf.org/doc/html/draft-wilson-class-e-0...
- londons_explore 4y agoThere are a bunch of users for whom 10/8 is insufficiently large, but 240/4 is big enough. I suspect both AWS and Verizon fall into that category.
- kosherhurricane 4y agoIf such huge companies who has both the need and the resources to use ipv6 internally would rather stick to 240/4 or 10/8 ipv4, what hope do smaller organizations have of adopting ipv6?
- onphonenow 4y agoI chased ipv6 hard for a while. Concluded not worth it. Do a fan of proposals to inch up address space in various ways
- ajross 4y agoThat's how I'm reading it too. "IPv4 addresses are scarce and networks play dirty tricks to make things work, news at 11!" We know, folks. IPv4 is awful for network operators in the modern Internet of Way Too Many Things. Let them have their tricks.
- cloudymeatballs 4y ago
- tacker2000 4y agoI guess the big companies are not really keen to move to IPv6, since they control large swaths of IPv4 territory anyway. And only they would have the power to initiate a move, so i guess we are stuck in somewhat of a limbo here…?
- b112 4y agoI think they're waiting for ipv8, as I am, which is really just an extra octlet at the start of the IPv4 block. ipv6 is windows me. Skip over it. Wait for ipv8. edit: Oh! We could make ivp8 just 16bit instead of an octlet!
- wollsmoth 4y agohaha, oh man you had me going there for a second.
- b112 4y agoI've been thinking, we really just need lots and lots and lots of IP addresses, far more than we realise right now. ipv8? Should probably be ipv32 or some such. An example ; when we start throwing smart nano on the grass, to see how each blade of grass is doing on your lawn. Well, each nano is going to need an IP address, and so will all in the neighbourhood. And that's just the grass. What about when some scientist wants to track sand dispersal patterns, on a beach, after a hurricane? And wants to have each grain of sand tagged with its own nano hitchhiker? Just think of the IP addresses we'll need then! And even medicine. What if we want to interally tag each cell in our bodies with nano? What if we want to bioengineer our body, so that each cell has its own IP address? And can report health/condition? No, we need more, more more IP addresses! So many more.
- lbotos 4y agoI mean, IPv6 is a lot of addresses: https://www.techtarget.com/whatis/feature/IPv6-addresses-how-many-is-that-in-numbers https://www.techtarget.com/whatis/feature/IPv6-addresses-how...
- b112 4y agoIn sum, we only found two companies that are using 240/4 IP space privately. If anything, this is almost a warning from ARIN that this block might be finally repurposed. They find no one using it except for two companies internally ; they're seeking to see if 240/reserved is used or not is seems. And really, anyone using 240 is to blame if it does get repurposed, so it seems like a good idea.
- knorker 4y agoTo blame, maybe. But say you get a class E network. Are you fine not being able to talk to anything hosted on AWS? Blame is not correlated with pain.
- MrStonedOne 4y ago
- b112 4y agoIt may take a year or two, but I think AWS would clean up its act. I'd be worried about some megacorp using it inside some deep internal project, and for a decade after having bizarre deliverabilities issues for mail or something, randomly, without its staff understanding why.
- knorker 4y agoI think a year or two may be optimistic. One can only assume that if you start using class E then you've already used up all of 10/8. So the only option is to move to IPv6. I don't know AWS internals, but they may need to do hardware revisions they need to roll out to switch ASICs, not to mention millions of lines of code. And the addresses will be "kinda broken" everywhere, basically forever. So AWS wouldn't even get the blame. So there's no incentive for them to have a moon landing program costing them many billions, throwing away hardware before they otherwise would. Of course it is 2022, so I would hope that AWS's current production hardware is IPv6 ready at equal pps, FIB size, and features, but I wouldn't be surprised if not. But the software should not be underestimated. That IPv4 address in a database, stored as 32bit integer, is not exactly trivial to extend on disk and by every single reader and writer. Nobody will want these second class addresses, not on the client nor the server, so who are they for? (on the public Internet, that is. They could be used as 100.64.0.0/10)
- knorker 4y agoI know multiple large companies that would have no choice but to block any public use of these, as they have databases where these addresses have special meaning. Yes, obviously that was a terrible choice to make. But it's there. And legal compliance means they can't just let these addresses in as normal unicast. So while these can work as rfc1918 and similar, nobody will ever want to use these on publicly facing clients or servers. Too many places will never support them. I'd rather be behind 3 layers of CGNAT.
- icedchai 4y agoPlus there's tons of legacy equipment that simply won't work with 240/4. It will be a support nightmare. Arguably, opening up 240/4 could've been done around the time we started rolling out IPv6... It's a bit late now.
- bpye 4y agoPresumably when IPv6 was being rolled out the intent was to actually move to IPv6 instead of trying to keep IPv4 on life support indefinitely...
- OJFord 4y agoFor it to be visible at BGP level I suppose they must be used publicly? But that aside, as a a bad practice, surely you can basically use any IP that you're not supposed to, as long as you don't care that it stops the real one being reachable? I.e. 'reserved for future use' can be considered 'private use if you must, for now, may change without notice'?
- wongarsu 4y agoThey are only visible in traceroutes. Ripe seems to operate devices to collect BGP stats that also do periodic traceroute. Some of the packets they sent out crossed a router with IPs in the 240/4 block, but those are only used internally and not advertised outside the AS (apart from the suspicion of different Amazon AS advertising their 240/4 addresses to each other).
- inopinatus 4y agoRIPE have been running Internet observatories for decades. I remember the members of the TTM (test-traffic measurement) project in the late 90s trying to get ISPs to install GPS receivers on the DC roof for accurate one-way latency observations.
- Ao7bei3s 4y agoThis is using RIPE Atlas. The actual probes are tiny consumer grade routers (https://www.google.com/search?q=ripe+atlas+probe&tbm=isch https://www.google.com/search?q=ripe+atlas+probe&tbm=isch) with a new firmware. RIPE provides these free of charge to volunteers (people and companies) who then run them in their network (e.g. homes and datacenters). (Of course larger form factors are available to volunteers with more in-demand locations.) In return, volunteers get rewarded for uptime of their probes with credits that can be used to request custom measurements from the Atlas network. There are probes _everywhere_; not just in terms of geography (https://atlas.ripe.net/results/maps/ https://atlas.ripe.net/results/maps/) but also in network locations that you cannot get access to via any other means; there really is no other service that comes close in terms of reach for global internet status testing.
- pm2222 4y agoCouple points: a. Do linux/windows just take it 240/4 address without special attention? b. Fun time when 240/4 will be released to public in the future it's gonna be a huge headache for them.
- rb12345 4y agoLinux has supported 240/4 addresses for years, but Windows still does not.
- schoen 4y agoYeah, most Unix systems have been more or less OK with it since the prior round of Internet-Drafts in 2008. Some more details in the implementation status section in https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-240/ https://datatracker.ietf.org/doc/draft-schoen-intarea-unicas... (which I'll need to continue updating on the basis of more tests). The situation is more complicated for routers, including high-end datacenter routers. (If you have something that's post-2008 Linux under the hood, it probably works although there might be some higher-level software enforcing special cases.) The trend has been toward more router support for 240/4, but the special case was historically enforced in many devices, and older routers sometimes stay in use for quite a while. Windows is definitely the outlier on endpoints; when I gave some presentations about 240/4 over the past year I pointed out that, if people were watching them on a device running anything other than Windows, that device would most likely interoperate with 240/4 addresses.
- seligman99 4y ago> Moreover, we did not find any 240/4 prefix in the official prefix list shared by Amazon Yeah, so about that: https://github.com/seligman/aws-ip-ranges/commit/2e0d9d87d4f5f39d741ff72adbec3a95e12880b7 https://github.com/seligman/aws-ip-ranges/commit/2e0d9d87d4f... They did briefly list 252.0.0.0/10 in their published list of IP ranges. The people I spoke with about this at the time either claimed it was a mistake, or the state of the world that I should get used to (it broke some surprisingly fragile scripts on my side for silly reasons). Given they removed it from their list of IPs 27 hours later, I'm guessing I wasn't the only person freaking out. But yeah, they use it internally, and it leaks from time to time in surprising ways.
- stingraycharles 4y agoHow can it leak when they only use it internally? They would have to announce this IP range specifically through BGP et al, which I can only assume would raise some serious questions, given that they cannot possibly be the official owner of this range? On the other hand, that’s probably how we ended up with this article. I still don’t understand how this could have been an accident though.
- cthalupa 4y agoNo, these are being found in traceroutes. Any time you end up being routed over a private network you can end up with private non-announced IP addresses being present in said traceroute - seeing 10.x.x.x addresses in the middle of traceroutes is something you will see occasionally as well. When the TTL expires and the router sends the TTL exceeded message back, it has to select SOMETHING for the source IP address, and there's nothing to prevent that choice being the internal IP address it uses.
- schoen 4y agoBy the way, "found using" might sound like someone is angry at the companies for doing this, but the article doesn't criticize them. Some people do find it objectionable, but my focus would be on accelerating coordination about the use of 240/4 addresses, so people can agree on what behavior to expect. (I'm the first author of a current draft about that, https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-240/ https://datatracker.ietf.org/doc/draft-schoen-intarea-unicas..., and I contributed to this RIPE Labs article but didn't do the underlying research.)
- XionXIV 4y agocan someone explain what this means :p sorry
- justusthane 4y agoBig companies are using groups of IP addresses internally on their private networks which technically aren’t supposed to be used anywhere. This is mostly fine and no one cares too much.
- mr_toad 4y ago> This is mostly fine and no one cares too much. Until it breaks something, as was the case with 1.1.1.1
- 1letterunixname 4y agoYou can't dent the universe without breaking some things. It's inevitable. Adapt. Overcome. It'll be okay.
- gitrog 4y agoCould someone explain how this "breaking" works?
- justusthane 4y agoIf 240/0 ends up being assigned as private address space, it won’t matter since that’s how these companies are already using it. If, however, it’s assigned as public address space, then these addresses would potentially (depending on their routing) be unreachable from the networks of the companies already using them as private addresses.
- XionXIV 4y agoWhat happened with 1.1.1.1?
- 4y ago
- 1letterunixname 4y ago255.255.255.255 is the broadcast address and all other 240/4 are "for research purposes." IPv4 doesn't need "research" anymore because it's as dead as a whale oil barrel patch kit. I say fine: use them and un-bogon them. And then also deprecate the IPv4 internet by Dec 31, 2029. Can't migrate to IPv6 without having a real deadline. That's how it has to be because adoption that's optional never happens: look at the US and metrication.
- exabrial 4y ago> many people wonder why there is still a market for IPv4 This is so tone deaf. Put it this way, if Verizon, Google, and Facebook weren’t the champions for IPV6 for rolling it out, I’d be on board. First and foremost: ipv6 is unnecessary for the end user, ipv4 provides the default assumption that a casual anonymizing NAT is in use. And we can be real: SRV records, SNI, NAT work just fine and solved all the problems IPV6 went to solve _from the consumer perspective _. I know this comment will be incredibly unpopular on HN, but the points need to be addressed. Your ISP is not your friend and neither are these other companies that sell your information without your explicit consent.
- iggldiggl 4y ago> NAT work[s] just fine It's sort of tolerable if it happens on your home router which is under your control, but its absolutely a pain in the backside if it's done on the ISP level (CGNAT) and you want to self-host anything from your home network, like multiplayer mode in some games, or whatever…
- exabrial 4y agoJust curious, how does ipv6 solve multiplayer mode? Even with ipv6, you absolutely need to drop inbound traffic from the internet to devices on your LAN... am I not understanding something with ipv6?
- markus92 4y agoNo NAT traversal nor double NAT, you can just open the port on your firewall and it'd work.
- kaliszad 4y agoThis is a very simplistic view. IPv6 doesn't meaningfully improve or hinder your anonymity compared to IPv4 behind NAT. Facebook, Google will in the common case obtain way better fingerprint by using many techniques together. Your ISP has a contract with your address on it and is usually required by law to keep records. It will know what happens independent of IPv4 or IPv6 - you will still get the blame and privacy extensions have a similar effect here like NAT. If everybody was just a consumer all the time, we would have a very different (worse) society overall. There is a reason a subset of technical people do want IPv6 even if it means way more work for them.