Blackrock.
Can you elaborate or link to a source?
Who is squatting IPv4 addresses?
21–30 of 208 posts
Re: Who is squatting IPv4 addresses?
#22There is still plenty of IPv4 space available, it's just very badly distributed, for instance, due to early limits in Cisco's IOS, Chevron acquired an insane 26 Class B address blocks when connecting to the net back in the early 90s! With CIDR, we can easily reuse the many unused addrs like those, but the pain of readdressing has their owners sitting on them, raising prices and making them even more reluctant to turn…
Remembering and hand manipulating IPv6 addresses is not something end users need to deal with.
Like everyone else on my ISP, I have a publicly routeable v6 subnet at home and v6 addresses on my phones. I couldn't tell you what they are, but they work just fine.
Re: Who is squatting IPv4 addresses?
#23Earlier quoted context omitted.
That's not really what the author was getting at. The VPC endpoints just provide a way (via TLS certificate authority logs) for the author to discover DNS addresses that they can then use to check for queries and determine what IP addresses are being used in private networks. They found a number of AWS users that are treating publicly routable IP space as their own private IP space. If someone were to ever offer a pu…
I agree with you in general. If you do expect to be able to connect to the public internet and map an endpoint over a public address you are aiming a gun at your foot. However the point I was trying to make was about this quote: > This is useful since it can remove the need for some servers to have any outbound internet access at all. My point is that if you are not connected to the public internet at all I don't see…
This particular survey finds things that are connected to the public internet. For example, the WD NASes used are specifically those NASes whose owners have chosen to connect them to the public internet.
The squatters probably don't intend anything at all evil, but their address use conflicts with access to the general net. If you addresses that aren't yours and you expect to be able to connect to web sites in general, you might by chance use an address that is later allocated to a web site you'll want to use. If you squat on 193.168/16, that's 2¹⁶ addresses and you might block your own access to a few thousand web sites.
Re: Who is squatting IPv4 addresses?
#24> over 16% of all of the non-RFC1918 space is suspected squatted DoD space!
Well, I’m entirely willing to believe the US DoD is one of the few entities that have more than 2^23 computers they want to be mutually addressable, so the RFC 1918 space is just too small for them if they are to run IPv4.
Re: Who is squatting IPv4 addresses?
#25I have an old static IP from the days of running a server from my bedroom. My mom kept it after I moved out. Stopped responding to pings 2 or 3 years ago when she upgraded her internet package and the ISP didn’t honor our ”Hey we have a static IP” agreement.
Good old 193.77.212.100, may you rest in peace.
Re: Who is squatting IPv4 addresses?
#26Earlier quoted context omitted.
I agree with you in general. If you do expect to be able to connect to the public internet and map an endpoint over a public address you are aiming a gun at your foot. However the point I was trying to make was about this quote: > This is useful since it can remove the need for some servers to have any outbound internet access at all. My point is that if you are not connected to the public internet at all I don't see…
For what it's worth, I've these endpoints in use for VPCs that still had internet access. Meaning that if you attempted to read the "real" internet address you put your VPC subnet on, they would be unreachable. It's hard/impossible to figure out if the VPC in question has been setup this way. But I agree that it would be likely that most of these VPC with the endpoints on don't have internet access. However if we ass…
For sure, I'd bet that most of the examples you found were still connected to the internet. I don't think the findings are any less valid I just thought it was an interesting observation that if you are in fact disconnected from the internet there isn't really any reason you should follow the public internet's rules.
Re: Who is squatting IPv4 addresses?
#27> [...] if you want to get a /24 block from RIPE NCC when you sign up as a member, then you are currently looking at a 2 month wait for a recycled IPv4 /24 block.
That's a rather optimistic view of the situation. The next member who will get a block has already been waiting for 2 months and it's unclear when they will get one. It stands to reason that members applying now wold have to wait (potentially significantly) more than 2 months.
Re: Who is squatting IPv4 addresses?
#28One minor philosophical question. If you are using AWS PrivateLink because your VPC is not connected to the internet are you really squatting anything? You are just aren't using the public internet. This means that you own the entire address space and can decide what you want to do with it. Of course it still may make sense to stick to ranges you own in case you need to peer your VPC with someone else, but I don't se…
That's not really what the author was getting at. The VPC endpoints just provide a way (via TLS certificate authority logs) for the author to discover DNS addresses that they can then use to check for queries and determine what IP addresses are being used in private networks. They found a number of AWS users that are treating publicly routable IP space as their own private IP space. If someone were to ever offer a pu…
This is useful threat intel as well b/c many firms employ source ip address in policy constraints and log monitoring. However it's trivial to masquerade as a target IP address range in a private vpc, and overlap could indicate that someone is up to some tomfoolery.
(FWIW cloudtrail will include source vpc and/or vpc endpoint information when the request is coming through an endpoint. This will help detect those requests)
Re: Who is squatting IPv4 addresses?
#29About 10 years ago, IBM used to use the 9.0.0.0/8 space in basically exactly the same way as one would use 10.0.0.0/8, for internal-only networking. Each workstation got its own 9.x.x.x IP, but it wasn't routable from outside. I hope they stopped doing that, but I doubt it.
Apple was the same when I was there for 17.0.0.0/8
Re: Who is squatting IPv4 addresses?
#30About 10 years ago, IBM used to use the 9.0.0.0/8 space in basically exactly the same way as one would use 10.0.0.0/8, for internal-only networking. Each workstation got its own 9.x.x.x IP, but it wasn't routable from outside. I hope they stopped doing that, but I doubt it.
Was it still behind NAT?