Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
The Internet

The 69/8 Networking Problem 185

Posted by timothy from the modular-arithmetic dept.
jaredmauch writes "A number of networking providers who receive address space from ARIN have been having problems with their recent IP space allocations. This is a result of outdated filters that applied a few years ago during the boom time of the net, but have not been updated to reflect the current state of the network. Here is a paper that documents some of the problems this filtering is causing providers."
This discussion has been archived. No new comments can be posted.

The 69/8 Networking Problem More

The 69/8 Networking Problem

Comments Filter:

  • heh (Score:3, Funny)

    by ergonal ( 609484 ) on Monday April 14, 2003 @09:28PM (#5732808)
    Wine me, dine me, 69/8 me!

  • Devalued IP Space? (Score:5, Insightful)

    by numbski ( 515011 ) <numbski&hksilver,net> on Monday April 14, 2003 @09:28PM (#5732812) Homepage Journal
    I'm just looking over this, since I'm looking to purchase some IP's from my upstream provider. It seems to be that these IP's are somewhat devalued since areas of the net have blacklisted them.

    Sort of like a tarnished credit record I guess. This IP's won't be of the greatest value for a few years until the rest of the net catches up.

    The IP's would be for home broadband use too. I'll be personally avoiding that IP range. :(
    • You can't purchase IPs anymore. All IPs are now RENTED from the ISP in question. With routing protocols the way they are, there are very few portable classes available, and those are grandfathered. You can no longer buy a class and expect to keep it if you change providers. The IPs belong to the ISP/provider. All you're doing is renting them.

      • Re:Devalued IP Space? (Score:3, Insightful)

        by Binestar ( 28861 )
        You can get your own IPs directly from ARIN. But I guess others know that too because you were modded to 5 when I started writing this post, and when I posted it you were back to 4. There really needs to be a "-1 incorrect information" moderation.

        • Re:Devalued IP Space? (Score:5, Interesting)

          by Sandman1971 ( 516283 ) on Monday April 14, 2003 @10:29PM (#5733073) Homepage Journal
          Sure you can. But you also have to remember that most backbone providers will not accept BGP advertisements smaller than /19 (32 Class Bs). To get that kind of range at Arin, you have to prove something like 75% utilisation now, and up to 100% utilisation within 3 months. So unless you're an ISP/backbone/server/web farm or a big company, you'll have a tough time proving you need 8 class Bs.
          • I forgot to add:

            That is, unless you don't mind not being routed by more than half the backbones on the Internet, since most only accept /19 or bigger BGP advertisements.

            And yes, I do know what I'm talking about, being an ex-WAN Admin and current syusadmin for a big national backbone provider.
            • While that used to be true -- Sprint wouldn't accept anything longer than /19 because their routers didn't have the memory for it, it's not true anymore as modern routers can hold a great deal of memory. The generally accepted rule is not to do BGP for anything less than a /24. Anything less than /20 is not guaranteed to be globally routable but generally is.

              As I point out to (stupid) customers: Anything smaller than a /20 may not be globally routable; Do not complain to me if there are places on the net

              • Re:Devalued IP Space? (Score:3, Informative)

                by adri ( 173121 )
                You _can_ get lucky if you're _near_ the provider in question with the superblock you're in.

                Example: Say you've got x.x.x.0/24 out of x.x.0.0/16.
                Now, if people ignore you're announcement they're going to send traffic towards the provider announcing x.x.0.0/16. Somewhere along the way a network in the path might actually be paying attention to your routes, and your traffic gets shuffled towards you.

                (But then, somewhere between THERE and you might be a network which doesn't pay attention and it heads back t
                • Example: Say you've got x.x.x.0/24 out of x.x.0.0/16.
                  Now, if people ignore you're announcement they're going to send traffic towards the provider announcing x.x.0.0/16. Somewhere along the way a network in the path might actually be paying attention to your routes, and your traffic gets shuffled towards you.

                  I would say in this case the provider's advertisement is screwed up. Whay are they advertising a /16 if they don't have all the space under it?
          • So unless you're an ISP/backbone/server/web farm or a big company, you'll have a tough time proving you need 8 class Bs

            Sorry, I meant 32 class Bs, not 8.
          • Surely you mean 32 class Cs? (where 24-19=5, and 2^5=32.)

            There are large parts of 203 (203/10 if memory serves,) all of 192 except for the RFC 1918 bits, and several other blocks which most backbone networks will accept up as up to a /24.

            I have NFI about Arin, being Australian, but APnic (the same thing for these parts) has several provisions for getting large blocks of IPs without too much justification ('new service' applications etc.)

            I believe that most registries also allocate the bottom /20 of a /1
          • Sure you can. But you also have to remember that most backbone providers will not accept BGP advertisements smaller than /19 (32 Class Bs).

            A /19 is a lot smaller than a former Class B subnet, and obviously, you can't filter everything longer than /19. For example, you simply can't do this in the former Class C swamp space.

            Of course, in reality, the backbone providers are those who contribute most to the unnecessary growth of the routing table because they do not properly aggregate announcements.
      • here we do have a few of our classes directly assigned to us, and some others are rented from the upstream. long assigned to us tho :P

        offtopic, how would i go about getting those ip rerouted (if we ever decided to move to another upstream), the "portable" ones i mean :P
      • You're wrong. Portable blocks are allocated all the time. ARIN always disclaims that any block they allocate is globally routeable, however. But they disclaim that for all blocks, including the old ones allocated in ancient times. So the next allocation of a /19 has the same guarantee of portability that 4/8 does: none at all.

  • just in case... (Score:3, Informative)

    by Anonymous Coward on Monday April 14, 2003 @09:31PM (#5732822)
    mirror [no-ip.com]

  • I have a 69/8 address (Score:5, Interesting)

    by DetrimentalFiend ( 233753 ) on Monday April 14, 2003 @09:33PM (#5732827)
    ...and although most places have finally gotten their act together, this is still a bit of a problem for us. Our ISP has been working quite hard to get people to update their filters (the ISP was one of the first to get addresses in this space), but it's still a bit of a problem. Hopefully being on the front page of slashdot will help the problem some.

  • Roll on IPv6 (Score:5, Interesting)

    by The Real Chrisjc ( 576622 ) <slashdotNO@SPAMamoose.com> on Monday April 14, 2003 @09:33PM (#5732831) Homepage
    I would love everything to be IPv6 now, but it ain't gonna happen for atleast 10 years I think. Even new equipment hasn't got IPv6 :(
    That would solve problems like this, and create lots of lovely new ones :/

    If only the world was perfect eh?

    • Re:Roll on IPv6 (Score:1, Interesting)

      by Anonymous Coward
      >That would solve problems like this

      no, it wouldn't. unallocated ip's are still going to be acl'd out as illegal sources until such time as they are allocated regardless of ipv6 vs ipv4.

    • Re:Roll on IPv6 (Score:5, Informative)

      by silas_moeckel ( 234313 ) <silas@@@dsminc-corp...com> on Monday April 14, 2003 @10:00PM (#5732955) Homepage
      Your not going to see IPV6 untill they figure out how to bill for multicast traffic as it's REQUIRED to work inside IPv6 not optional like under v4. This is a HUGE problem in implementing it as you cant bill for it rationaly. How much sould it cost are home users going to be billed per megabit leaving there ISP? If multicast works lots of the current issues with the net can go away think bit torrent is fast think about file send loops via multicast just join as many as you have bandwith to receive. All of the routers etc etc out there have supported IPv6 for a long time I cant say that people are realy familiar with it but it could be made to work but you NEED to be able to fit a billing plan around it before any of the big guys are going ot make it work world wide.
      • Nothing is really required; after all, there's no "IETF police" that can punish ISPs that don't support multicast.
        • No, but there are other network providers that may not want to let you connect to them unless you support the protocol fully.

          eg. There is no IETF police stopping DoS attacks, it is technically possible. But do one through a network and all your upstream providers wont be too happy and will want to disconnect you. Its only because it can be done anonymously that the problem exists.

        • Re:Roll on IPv6 (Score:3, Insightful)

          by silas_moeckel ( 234313 )
          This is true but not supporting multicast means you cant call it IPv6. I say this because if you did sign people up for this new IPv6 option or whatever and dont support multicast to all your IPv6 peers then your could be sued as all your supporting is IPv6 numbering and that would be deceptive advertising.

    • Re:Roll on IPv6 (Score:5, Insightful)

      by rusty0101 ( 565565 ) on Monday April 14, 2003 @10:10PM (#5733014) Homepage Journal
      What new equipment does not support IPv6?

      BSD, Linux, MacOS X, and Windows XP, all have support for IPv6 in their network stack. Current Cisco IOS supports IPv6.

      There are some applications that go too far into the network stack to properly support IPv6, but those are applications.

      The main stumbling block to IPv6 that I see right now is that very few network people in the US know how to use it. Outside of the US, both in Europe and Asia, IPv6 is being deployed fairly widely, as they do not have the IPv4 address space availabable and allocated to make use of it except in servers and routers.

      As there are several gateways available, to allow IPv6 clients to access IPv4 servers, I suspect that the demand upone US providers to start supporting IPv6 devices is going to be long in comming.

      With 10 devices in my house that support IP, (live at the moment, several others not currently powered up) I would exceed the available IP addresses my ISP account allows. As a result I am effectively forced to use NAT and private IP address space, even if my ISP would rather I did not. On top of that I don't want to keep a bunch of systems widely available to script kiddies. IPv6 would not solve that problem.

      Then again, that's probably just all opinion on my part.

      -Rusty
      • The main stumbling block to IPv6 that I see right now is that very few network people in the US know how to use it. Outside of the US, both in Europe and Asia, IPv6 is being deployed fairly widely, as they do not have the IPv4 address space availabable and allocated to make use of it except in servers and routers.

        Yet another reason the US tech sector is going to fall behind in the comming years. Between complacency and greed, we're done for. I gotta move.

      • Re:Roll on IPv6 (Score:3, Insightful)

        by Cato ( 8296 )
        Even my phone supports IPv6 - it's a Symbian 7.0 smartphone, the SonyEricsson P800, and is widely available in Europe and Asia. See http://www.sonyericsson.com/ for details.

        However, Cisco routers deployed in networks today typically run IOS versions that are pre-IPv6 and the IPv6 IOSes are somewhat less stable than the preferred 'S' train (the 12.2T train is the place for IPv6 at present) and upgrading a whole network is a fairly large undertaking even though it can be done step by step.

        Upgrades will happ

      • Re:Roll on IPv6 (Score:3, Interesting)

        by Omnifarious ( 11933 )

        IPv6 could provide almost as much protection as a NAT.

        Every single network gets at least a full /64 in IPv6. 64 bits is a lot of bits. Your devices IPs wouldn't be guessable. Script kiddies would have to run a very noticeable address scan, and even that would not be likely to find a randomly numbered device in a reasonable amount of time.

  • Not surprising (Score:4, Interesting)

    by Anonymous Coward on Monday April 14, 2003 @09:34PM (#5732837)
    Frankly this isn't a big surprise. If IANA gave up another previously reserved netblock like 0.0.0.0/8, 96.0.0.0/4, 112.0.0.0/5, 120.0.0.0/6, 124.0.0.0/7, 126.0.0.0/8 or the plethora of other reserved netblocks then they should expect peeps to still have them blacklisted in their personal ACLs. This is only common sense. This isn't exactly news. IANA should have been very forthcoming and gone public with the fact that a previously reserved netblock was no longer reserved PRIOR to selling parts of it. How else would they expect admins like myself to know about the change?
    • 0.0.0.0/8 will always be reserved, do the math to see why
      • now, speaking as someone who doesn't really know shit about this....

        isn't 0.0.0.0 used locally to mean localhost's *.*.*.*? I thought linux services set to 0.0.0.0 just assumed to listen to all IP's on that machine?

        Just curious about this. about to jump up a big notch on the network, and actually need to learn more than I will.

        • Re:Not surprising (Score:5, Informative)

          by lucifuge31337 ( 529072 ) <daryl@intros[ ]t.net ['pec' in gap]> on Monday April 14, 2003 @11:47PM (#5733393) Homepage
          0.0.0.0/1 means any address between 0.0.0.1 and 255.255.255.254. 0.0.0.0/8 is much different, meaning any address between 0.0.0.1 and 0.255.255.254. So, basically what I'm saying is that it can mean "all IP addresses (in IPv4 space)" or it can denote a smaller subset of addresses beginning at 0.0.0.1, depending on what subnet mask is applied to it.

          The "problem" with using blocks like that are not technical....just like using addresses ending in .0 as valid IP space is also not a problem in the right network blocks.....it's broken sysadmin's understaning of IP that causes issues.

          Oh...and there that nasty problem of certian addresses lying on bondaries that cause routers that don't properly understand classless routing to choke, but honestly...how many edge device could possibly be out there that are that dated to still have that problem? At least how many that are in a backbone situation where their being broken would actually effect more than 10 people?

          • Re:Not surprising (Score:5, Informative)

            by Michael Hunt ( 585391 ) on Tuesday April 15, 2003 @12:37AM (#5733590) Homepage
            It ain't just broken routers.

            I was recently assigned a /29 from my DSL ISP at home. Since the whole thing runs on NAT, this gives me 8 IPs not 6, since NAT ranges have no concept of 'broadcast' or 'network' addresses (which only have link-local significance, and there's no link.)

            Unfortunately, the /29 fell at the top of the /24 in question (202.59.108.248/29.) This means that 202.59.108.255 is one of the IPs which are being routed to my network. Cool, right?

            Wrong. Having configured static NAT between that IP address and a machine on the inside of the network (172.18.16.24, case in point,) the machine was reachable from Unix and Linux machines, but not from Windows boxes.

            Further testing reveals that Windows still uses classful logic to determine whether an IP is 'valid' or not. On attempting to ping 202.59.108.255 from a slew of windows 2000 boxes, tcpdump showed nothing on the other end. An identical test from a unix box showed that it worked just fine.

            • Re:Not surprising (Score:4, Funny)

              by lucifuge31337 ( 529072 ) <daryl@intros[ ]t.net ['pec' in gap]> on Tuesday April 15, 2003 @12:45AM (#5733629) Homepage
              Further testing reveals that Windows still uses classful logic to determine whether an IP is 'valid' or not. On attempting to ping 202.59.108.255 from a slew of windows 2000 boxes, tcpdump showed nothing on the other end. An identical test from a unix box showed that it worked just fine.

              This is /. Rephrase your observation in the form for a blatant MS-bash and tell everyone that's why they should be running Linux.
              There will be no more warnings for this type of blantant oversight. I trust it will not happen again.

          • Re:Not surprising (Score:5, Informative)

            by Alien Being ( 18488 ) on Tuesday April 15, 2003 @01:35AM (#5733760)
            "0.0.0.0/1 means any address between 0.0.0.1 and 255.255.255.254"

            Shouldn't that be "any address between 0.0.0.1 and 127.255.255.254?"
            • "0.0.0.0/1 means any address between 0.0.0.1 and 255.255.255.254" Shouldn't that be "any address between 0.0.0.1 and 127.255.255.254?"

              Of course, you're right. I should have said 0.0.0.0/0. It's not often I work with /0 networks, so I'm a bit rusty ;)

        • Re:Not surprising (Score:5, Informative)

          by Wild Wizard ( 309461 ) on Monday April 14, 2003 @11:52PM (#5733428) Journal
          handy link on 0.0.0.0 [zvon.org]

    • Re:Not surprising (Score:5, Insightful)

      by gclef ( 96311 ) on Monday April 14, 2003 @09:45PM (#5732893)
      ARIN did notify the public. ARIN, RIPE, APNIC, etc are often announcing allocations to groups like NANOG. I don't see how much louder they could be. If you're filtering based on their reserved lists, it's your responsibility to keep up with their allocation updates.

      The problem is not the allocator's fault...at least, not directly. The problem is that lots of folks put in filters based on the bogon list at the time of their firewall/soho router install, and promptly forget about the fact that those filters should change (or, more likely, the consultant left).

      There's nothing that ARIN, IANA or anyone else can do to enforce clue at the edge of a network. Hence the problem. If you're not prepared to keep up with groups like NANOG, don't filter unallocated space.
      • This is why it makes more sence for a dynamic and secure Bogons route feed. To bad I haven't seen one yet.
      • ...however, I'm not in North America (I'm in Australia). Is there some other group I should be keeping up with, or is NANOG still it?
      • ARIN did notify the public. ARIN, RIPE, APNIC, etc are often announcing allocations to groups like NANOG. I don't see how much louder they could be. If you're filtering based on their reserved lists, it's your responsibility to keep up with their allocation updates.

        They used to have a link on the home page of their web site clearly showing new blocks that were previously unassigned that were now in use. It was quite useful, I checked it often. Then at some point, they decided that was too useful or somet

    • exactly (Score:5, Interesting)

      by ArchieBunker ( 132337 ) on Monday April 14, 2003 @09:58PM (#5732948)
      Theres a ton of companies sitting on class A blocks and doing nothing with them. Anything from 4.0.0.0 and up is hardly used. Redistribute these as a temporary solution until IPv6 is mainstream.

      • Re:exactly (Score:4, Informative)

        by marvinglenn ( 195135 ) on Tuesday April 15, 2003 @01:19AM (#5733705)
        Theres a ton of companies sitting on class A blocks and doing nothing with them. Anything from 4.0.0.0 and up is hardly used. Redistribute these as a temporary solution until IPv6 is mainstream.

        Exactly. Here are a few of the class A's that I don't see valid reason for the holder of them to have a block of such size:

        019/8 Ford Motor Company (a car company)

        040/8 Eli Lily and Company (a drug company)

        048/8 Prudential Securities Inc. (an insurance company)

        051/8 Deparment of Social Security of UK (a government department in a relatively small country that has a ridiculously unproportional share)

        056/8 U.S. Postal Service (the opposite of email)

        There are a handful more which you can see here: http://www.iana.org/assignments/ipv4-address-space [iana.org]

        The fact that these companies are cyber-squatting on more than they could resonably need torques me off to the point that, if I run out of unroutables (10/8, 192.168/16, etc) for my intranetworking, I'm going to lay claim to a block or two of those class A's for my intranet and firewall them [existing squatters] off to the outside.

        • If you run out of unroutables, you're managing "your" namespace as badly as IANA are :)

          Go for IPv6. You can get a /48, which is 2^24 subnets each of 2^64 addresses from most ISPs, tunnel brokers, etc.

          • Doh. 2^16 subnets I meant. 65536 subnets, each of up to 18446744073709551616 hosts.

            Does anyone else think it's a bit silly to make the "smallest" subnet /64 ?

        • When I worked for the Army, one of the Generals had a public class C in his house. Two decives, his computer and his router.
        • Umm... do you have any idea how large PruSec *is?*

          16.7 million IPs is overkill, fine, but 256 Class Bs, or 65536 Class Cs (yes, I'm overgeneralizing) might actually make sense for them. Granted, VPNs eliminate a lot of the need that they might have had in the past for public IPs going everywhere, budon't like thatt any corporation of Prudential's size will have enough employees, offices, and servers to utilize a fairly large portion of a class A. It's not like it's some simple flat address space which ca

      • Re:exactly (Score:3, Interesting)

        by Anonymous Coward
        Why do think HP bought Compaq?
        now they have 15/8 and 16/8 two consequecutive class A

    • Re:Not surprising (Score:5, Funny)

      by jmt9581 ( 554192 ) on Monday April 14, 2003 @10:39PM (#5733111) Homepage
      Curse slashdot for making me wonder "I Am Not A What?" as I skimmed over this comment . . .

      While IANAL (linguist, not lawyer :) the namespace for acronyms is really becoming overcrowded. :)
  • Why were they filtered out in the first place? It doesn't make sense and I believe the press was talking about running out of IP addresses on the internet back in the late 1990's. If anything more addresses are now available as .coms fade away.

    • Re:Could someone explain this (Score:4, Informative)

      by jaredmauch ( 633928 ) <jared@puck.nether.net> on Monday April 14, 2003 @09:55PM (#5732934) Homepage
      We have a few things that happened here I believe. Denial of service attacks lead the reason people would filter out 'unallocated' space. A bunch of people just used rand() to generate fake source IPs to DoS from. Dropping from unallocated or unrouted space has become commonplace as it can prevent that extra little bit of packets from reaching your firewall/router/end host. It can make the difference for some people being able to survive an attack and not. The "dot com" bubble that burst created a lot of devices that used to be cared about deeply and now are ignored by the suits as the network is too stable and runs itself. This is both good and bad. As the network becomes more reliable more people start using VoIP and other technologies that reduce costs. Problem is this ends up causing jobs to be lost. (VoIP aside, if you take 250mil phone calls all going on at the same time, using 64k per call, you've got ~16Gb/s of traffic. Most of the international backbones can easily handle this traffic. What does this mean for the existing PSTN networks once the IP networks are more reliable.) People are just busy. I know that I sometimes lag in updating software on my systems unless it's necessary. Imagine the people who think "hey, i need to update these filters" but never get around to it.

      • Re:Could someone explain this (Score:5, Insightful)

        by Pharmboy ( 216950 ) on Monday April 14, 2003 @10:12PM (#5733020) Journal
        Your raise a really good point. Also consider most major companies have cut IT staff to reduce costs, and most IT professionals have tolorated it because there are less jobs, meaning fewer people doing more work (and more burnout). I can easily see the lists not getting updated because "if it aint broke, dont fix it" mentality. Many ITs simply have plenty of other stuff to do, and if their company isn't hitting anything on 69/8 or vise versa, then it wont get fixed.

        Good upkeep? Maybe not. Best some can do under the circumstances? Probably. I have enough hell just keeping up with the relatively small amount of shit I have to keep up with, so I can sympathise.

    • Re:Could someone explain this (Score:4, Informative)

      by afidel ( 530433 ) on Monday April 14, 2003 @11:43PM (#5733360)
      They were filtered because prior to being allocated the only uses for them were nefarious in nature (basically spoofing). If everyone did proper egrees filtering this wouldn't be necessary.
    • No, that's not insightful. -1, Stupid Moderators.

      There are several reasons why blocks are reserved by ARIN. Some of them are reserved because they fall on classful routing boundaries, some were reserved based on wanting to keep contiguous space free for various purposes including but not limited to RIPE and APNIC allocations, allowing flexibinity for large network to renumber out of non-contiguius space, etc.

      Don't think I'm sticking up for ARIN. Their policies are poor, mostly undocumentated in their actual application, and their customer service sucks.
      • except the is space is considered classless now, class a,b,c, and the rest of those weird ones are now considered obsolete terms. because other netmasks exist other than /8, /16, and /24.
        • except the is space is considered classless now, class a,b,c, and the rest of those weird ones are now considered obsolete terms. because other netmasks exist other than /8, /16, and /24.

          Of course, but their policy moves at the speed of continental drift. I'm stating original reasons for reservations.....not claiming their continued validity.

  • This is a marketing issue (Score:5, Insightful)

    by southpolesammy ( 150094 ) on Monday April 14, 2003 @09:45PM (#5732889) Journal
    While the 69/8 netblock has been long known to be reserved, and has been subsequently been "used" by script kiddies and the like for DoS attacks, then if ARIN has decided to open that netblock for sale, then it is up to them to notify and market the netblock as no longer being reserved. Pretty simple actually. This is a case where a non-technical solution is ideal to address what has been a technical problem.

    If ARIN isn't doing that, then shame on them. If they are doing that, and we're just ignorant of it, them shame on us.

    • Re:This is a marketing issue (Score:4, Funny)

      by JoeBuck ( 7947 ) on Monday April 14, 2003 @10:01PM (#5732962) Homepage

      And the answer is:

      Shame on us.

    • While the 69/8 netblock has been long known to be reserved, and has been subsequently been "used" by script kiddies and the like for DoS attacks...

      Part of the blame belongs to the ISPs which let IP packets source from their network that should have been obvious (to the ISP) were forged. Specifically, letting packets out to the upstream with an address forged into the source IP that is obviously not on their network.

      Because of the sloppiness, apathy, or ignorance of such ISPs, it's only natural that oth

  • Love those dusty old filters... (Score:5, Insightful)

    by PZona ( 628953 ) on Monday April 14, 2003 @09:45PM (#5732895)
    I sometimes wonder, given all the tech layoffs in the last two years, if half the 'net was left running on autopilot. Keeping the filters up to date with current practices would be a lot more likely if there was an adequate number of admins left to man the guns.
    • That's precisely what I was thinking. The small web company I used to work for (I was one of several laid off to stop the company going under) has a webserver/nameserver/mailserver that's been running pretty much sysadmin-less for the last 6 months or so.
      I'd obviously set it up too well.. :)

      And no, I won't be vindictive and post the server URL in the hopes of a slashdotting :p

  • Unreserved some time ago (Score:2, Funny)

    by Anonymous Coward
    Is it just me or was this block removed from the reserved list by IANA and assigned to ARIN roughly midway through 2002? Man, the lag is getting worse around here all the time..........
  • Find the Internet's most notorious spam-supporting ISPs, like Qwest and Verio and anything in China or Brazil. Revoke all of their allocated IP space and give it to ISPs requesting new IP allocations, then redistribute the 69/8 IP addresses to Verio, Qwest, etc. That way no one will need to update their filters.

  • How much?!! (Score:1, Offtopic)

    by _ph1ux_ ( 216706 )
    For 69.69.69.0/24????

    Thats the C I want!

  • 69/8? Screw 'em! (Score:5, Interesting)

    by Anonymous Struct ( 660658 ) on Monday April 14, 2003 @10:29PM (#5733072)
    When I started working for the company I'm working for, whose name shall remain unpublished, there was a bit of funny going on with the ip addressing schemes of our various offices. Instead of fooling around with that silly private address space nonsense, they just went allocating /8 blocks devil-may-care, one for each office, and I'll just say there were more than ten of them. Oddest bit was, nobody really seemed to notice all that much, except for the few odd folks who'd try to visit their alma mater's website and met with frustration every time. 128/8 and 129/8 were mysteriously always unavailable.

    So 69/8 is blacked out? Ah, big deal. At least the dba can get to Oracle's website now. 192/8 was an office with about 60 people, if you can believe that. Strange folks out there setting up networks. Shield your young.
    • I just hope they've done this more than 20 times, and the network mafia go around and remove an appendage for each time they'd set up someone with a bogus IP address like that.

      Still, I suppose if it is being NAT'd properly, it maybe ok, I guess [pained look].

      • Not OK unless you do double NAT + DNS translation[1], or use proxies, OR nobody on such a network will ever want to communicate with the site which is legitimately using that address.

        Otherwise the gateway machines would get confused on which 69.x.x.x the packet wants to get to.

        [1] If the network is badly screwed up, good luck finding enough reserved/unused network ranges for the swap tho. There are just so many reserved spaces to use.
    • wow, 129/8 is where I go to school, that's pretty funny.

      Oh, and whoever set up your network is a moron.
    • Boy, can I relate to this. My company recently aquired an office which is set up using 202.202.202.0/24. Then They're NATing it for internet access. Apparently someone know enough to use NAT, but didn't know to use RFC1918 addresses. Thankfully, we're going to be re-numbering this office soon. As luck would have it, they're the biggest whiners about the shortest amount of downtime so it's been a pain trying to get them to let us change it. I mean, is 10 minutes of downtime at 3am on a Sunday all that
  • Last year I had to rush over to a client to look at why they couldn't send email with their lawyers and, ironically, the firm I worked for (which was an on-going issue).

    Turns out that a previous admin blocked all the "reserved" nets, including the 65/8 net which the lawyers and my firm were in.

    Blocking these seems like a good idea, but it tends to get neglected and only causes problems in practice.
  • Apparently the 69.0.0.0/8 is enough of an issue that folks on that address space can't even read this article [atlantic.net] on slashdot.org.
  • While I do have the occasional site that wont respond, I havent noticed more than did the same with my other provider (not on the 69/8). Guess it deserves me lookin into a bit further..

    Tm

  • ISPs and weird filtering (Score:3, Interesting)

    by phorm ( 591458 ) on Monday April 14, 2003 @11:42PM (#5733344) Journal
    Have you ever had a IP address that you just couldn't get to, though you were positive that it was up and online?

    So... you go over to a friend's (or for those who can , SSH to an alternate machine) and the IP is accessible. You know the site is available, so you spend a lot of time in the firewall settings, even opening the firewall entirely... but still no luck.

    I had this problem with my ISP, and finally traced it to that 66.xx.xx.xx IP addresses were unreachable (including redhat.com, very annoying), but only when I was on a certain bank of dynamically assigned IP's. Releasing my IP and leaving the PC off overnight used to solve the problem.

    For awhile, it was occuring after I got a dedicated IP as well. When I called my ISP on this, they told me to reboot my modem, let it sit off for about 15, and then restart. Try explaining to low-tier tech support about how downtime is bad when you run a server.

    Luckily, all is fixed now, since I've moved to another city (same ISP, but no problems), but I wonder if this problem is related to base ISP-side filtering, or if anyone else has experienced it. At one time, I had a box with a non 66.xx.xx.xx IP and a box with a 66.xx.xx.xx IP and they couldn't even talk to each other properly, though both could get online without a problem!
    • At my former employer we had a similar experience.

      One of our customers was having trouble accessing some of our servers, in particular one /24 couldn't talk to most of the internet. Unfortunately this included the main corprate outbound mail servers.

      This apparently caused quite the fire drill at our upstream provider, a couple of their upstream providers, and our customer's upstream.

      Turned out the problem was caused by Verio leaking bogus BGP advertisements that included our block. Unfortunately it took

  • Testing 69/8 (Score:4, Informative)

    by Leme ( 303299 ) <jboyce.ci@redding@ca@us> on Monday April 14, 2003 @11:53PM (#5733437)
    Jon Lewis setup a nice utility to test if your network is affected by outdated filters.

    http://69box.atlantic.net/ [atlantic.net]

    It includes a nifty traceroute utility that you can use to test with.

    As a holder of space in the 69/8 range, I'll admit the problem is annoying, but thanks to people like Jon, and this posting on Slashdot, hopefully it will go away.

  • Boy I must be tired... (Score:5, Funny)

    by Anonvmous Coward ( 589068 ) on Tuesday April 15, 2003 @01:14AM (#5733693)
    "The 69/8 Networking Problem"

    When I first read that, I thought 69/8 was a reference to my boss's sense of time. "To beat the competition, you must work 69 hours a day, 8 days a week!"

    Man I hate crunch time.

  • 1 stone, 2 birds, kill (Score:3, Interesting)

    by Skapare ( 16644 ) on Tuesday April 15, 2003 @02:43AM (#5734062) Homepage

    I was originally going to propose this for 126/8, but this netblock seems more appropriate. ARIN should take 69/8 back and re-assign it specifically for the purpose of spammers and their hosting services. Make it illegal (like maybe a death penalty) for doing any spamming or hosting any spammers unless it's done from this block of address space.

  • Allocation (Score:5, Funny)

    by karlm ( 158591 ) on Tuesday April 15, 2003 @06:36AM (#5734509) Homepage
    Back in 1997, my MIT fraternity house had a /16 network in a house zoned to house 22 people. That's about 3,000 IP addresses per person or 16 IP addresses per square foot (a very crowded house, we moved to a much bigger house later). This is probably a world record for IPv4 address density. (The MIT low-cost residence might have beat us.) It appears that MIT has gone to routing only two /24s to the house now and left the other 254 /24s unallocated.

    Some countries only get a sinle /24 network. The IPv4 space is full of huge differences in per capita allocations. There are tons of cases where huge corporations and universities have hundreds or thousands of times more unused addresses than used addresses. IPv4 routing tables would get unmanageable if you tried finer grained allocation, but there is little objective reason why MIT needs 16 million public IP addresses. When you have several hundred IP addresses per person, it's no wonder the MIT Media Lab comes up with ideas like IP-enabled tennis shoes.

    • Re:Allocation (Score:3, Informative)

      by nakaduct ( 43954 )
      IPv4 routing tables would get unmanageable if you tried finer grained allocation

      A routing table with entries for every /24 requires a stunning:

      117 440 512! bytes!

      ... or, roughly $12 worth of RAM, at today's prices.

      I'm not sure what you mean by "unmanageable": it's been a long time since backbone routing tables were managed by hand. There may be good reasons for small routing tables, but inherent cost and/or complexity of management are not.

      • Re:Allocation (Score:2, Informative)

        by obidex ( 447520 )
        care to explain that one?

        each entry requires (at the very minimum) prefix, netmask and nexthop. this is before you remember it's bgp, and has to hold a whole host of other shit (communities, as-path, metric, localpref, weight, origin etc).

        i make that:

        2^24
        = 16777216 /24s
        16777216*96
        = 1610612736 bits for prefix,mask,nexthop
        1610612736/8
        = 201326592 bytes for the very basics

        You can safely double that (at the very least) to factor extra bgp overhead gubbins. Take a third off for route compression, and double t
  • Speaking of which, don't bother with ARIN -- come to me. I have to raise some money and have some spare space. So if you need a /16 or /24 get a hold of me.

    (oh, it's not in 69.x.x.x either!)
  • I was informed by an admin that used to work at a General Electric subsidiary in Ireland that they use 3.x.x.x on all of their internal networks, NAT, and completely firewalled off. It seems that there are a few hundred machines that actually face onto the net worldwide amongst all of the companies under the GE umbrella.

    Is it time that the use and allocation of such an address space be examined more closely?

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close