Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is China doing with 1.1.1.1?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 18 posts

Ask HN: What is China doing with 1.1.1.1?

#1

Post by Monotoko »

So I'm currently in Shanghai and tried to ping 1.1.1.1, and surprisingly I got a response!

* 64 bytes from 1.1.1.1: icmp_seq=1 ttl=250 time=3.46 ms

* I get a 19ms response from my 4G mobile network

* I get no response from a server in Hong Kong.

I looked it up and apparently it's a APNIC research prefix, so I decided to do a traceroute and got this:

traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets 1 gateway (172.20.0.1) 0.370 ms 0.204 ms 0.443 ms 2 27.115.97.209 (27.115.97.209) 1.166 ms 1.157 ms 1.150 ms 3 112.64.249.197 (112.64.249.197) 3.351 ms 3.350 ms 3.343 ms 4 58.247.223.18 (58.247.223.18) 4.203 ms 4.204 ms 4.197 ms 5 1.1.1.1 (1.1.1.1) 5.927 ms 5.926 ms 5.919 ms

My question is why on earth have they routed 1.1.1.1? If I go to 1.1.1.2 it goes beyond the city and fails somewhere upstream.

Re: Ask HN: What is China doing with 1.1.1.1?

#2

Post by bcoates »

1/8 was reserved for a long time and various entities improperly used it as a private address. It was eventually given to APNIC for assignment use but a few ultra-commonly-used ranges and addresses like 1.1.1/24 and 1.2.3/something were never assigned because they get so much noise traffic and would break so many things.

It's improper for anything to use these unassigned in-theory-globally-routable addresses but there are no real hosts there and lots of local networks use them for random internal purposes. At least one commercial Wi-Fi hotspot uses 1.1.1.1 as a captive portal address.

Here's an incredibly detailed report on the situation on the 1-network: http://www.potaroo.net/studies/1slash8/1slash8.html

Re: Ask HN: What is China doing with 1.1.1.1?

#5

Post by Monotoko »

microsage wrote: post #4

I'm also in Shanghai, on a China Telecom hardline, I get nothing from 1.1.1.1: PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data. --- 1.1.1.1 ping statistics --- 80 packets transmitted, 0 received, 100% packet loss, time 79915ms What mobile network are you using?

China Unicom (I think) my work also has a Unicom line.

Re: Ask HN: What is China doing with 1.1.1.1?

#7

Post by lathiat »

mrkrabo wrote: post #3

That's funny. I use 1.0.0.0/24 for my home network. Perhaps they're doing something similar.

You are part of the reason we have these problems :(

While that's probably never getting allocated at this point, that's also what everyone thought 10-20+ years ago about 1.0.0.0/8 and yet here we are.

When my organisation was allocated from 110.0.0.0/8 a few years back we were constantly seeking out others to remove us from their "bogon" filters blocking unallocated ranges that were static and not being maintained. Including big organisations like Commonwealth Bank of Australia. It was a real pain. Meanwhile the security advantage of this behaviour is highly dubious in my view - just as easy to steal an otherwise valid but un-used (or even used) prefix.

Thanks for reading my rant this far if you did, I'll return you to your regularly scheduled more insightful comments....... now.

Re: Ask HN: What is China doing with 1.1.1.1?

#8

Post by trelliscoded »

So 1.1.1.0/24 doesn't seem to be in the global table from North American carrier perspectives. It's certainly not a routed prefix for any of my machines in North America. The closest prefix I can see an announcement for on a global basis is 1.1.3.0/24 (CHINANET FUJIAN PROVINCE NETWORK).

Like bcoates said, there's a bunch of dumb stuff out there designed by people who barely understood TCP/IP and used non-RFC1918 ranges for customer equipment. Occasionally they leak indirectly into a table that's being redistributed into some mom and pop ISP's BGP announcements, and this happens. The backbone carriers of the Internet all (well, maybe not tata) have much stronger filters than Honest Achmed's used car sales and Internet transit, so they tend to leak only within a country or region.

Occasionally its some ISP internal services and it's done deliberately to have easy to remember IP addresses for techs working on the network. I mean, do you want to have to remember to point SNMP traps to 216.31.49.167 or would you rather only have to remember 1.1.1.1 instead? Then the prefix hits the border bogon filter and remains entirely with that ISP's network.

Now that I think about it, scanning ISPs for known unannounced prefixes in the global table would be kind of a fun project to discover all the little internal services ISPs might have squirreled away throughout their network.

Re: Ask HN: What is China doing with 1.1.1.1?

#9

Post by jason_slack »

lathiat wrote: post #7
mrkrabo wrote: post #3

That's funny. I use 1.0.0.0/24 for my home network. Perhaps they're doing something similar.

You are part of the reason we have these problems :( While that's probably never getting allocated at this point, that's also what everyone thought 10-20+ years ago about 1.0.0.0/8 and yet here we are. When my organisation was allocated from 110.0.0.0/8 a few years back we were constantly seeking out others to remove us from their "bogon" filters blocking unallocated ranges that were static and not being maintained.…

I worked for a company once where each department had a public IP space, like 97.0.0.x or 98.0.0.x. When I told the network guy this wasn't proper and we should be using 192.168.x.x or 10.x.x.x he laughed and said "it really doesn't matter, nobody cares". To make all of these networks talk, share, etc they had to use a punch of equipment to tie each one in and then out via a Time Warner Road Runner circuit. This was about 1999 :-)
Post reply on HN