Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who is squatting IPv4 addresses?

blog.benjojo.co.uk

Post reply on HN
Print view View original

41–50 of 208 posts

Re: Who is squatting IPv4 addresses?

#41

Post by otabdeveloper4 »

xoa wrote: post #37
emilecantin wrote: post #14

About 10 years ago, IBM used to use the 9.0.0.0/8 space in basically exactly the same way as one would use 10.0.0.0/8, for internal-only networking. Each workstation got its own 9.x.x.x IP, but it wasn't routable from outside. I hope they stopped doing that, but I doubt it.

Why would that be relevant here (or sibling comment about Apple)? Last I checked except for 9.9.9.0/24 (to quad9) IBM is indeed the assignee for 9.0.0.0/8 from back in 1992. Apple got 17.0.0.0/8 back in 1990. Back in the day a lot of big entities got whole /8 blocks (including of course a lot of the USG but private corps as well). Many of them are still around and fully active, while others are defunct (Halliburton h…

But the point is that they're not using it. If it's not addressable from the internet, why not use 10.0.0.0/8 instead?

Re: Who is squatting IPv4 addresses?

#42

Post by aurizon »

Use it or Lose it. Back in the day companies were allocated large blocs of IP space. They do not own it - what they do not use should be allocated to others who will use it with zero compensation to squatters - they own nothing. Sadly some have valued the IP blocs as assets = boosted bottom line - and there are some large boosts! These people will whine and scream - but screw them, they are just squatters and deserve nothing. Valid users can easily be identified by network data.

Re: Who is squatting IPv4 addresses?

#43

Post by thedougd »

kevincox wrote: post #9
thedougd wrote: post #6

Earlier quoted context omitted.

That's not really what the author was getting at. The VPC endpoints just provide a way (via TLS certificate authority logs) for the author to discover DNS addresses that they can then use to check for queries and determine what IP addresses are being used in private networks. They found a number of AWS users that are treating publicly routable IP space as their own private IP space. If someone were to ever offer a pu…

I agree with you in general. If you do expect to be able to connect to the public internet and map an endpoint over a public address you are aiming a gun at your foot. However the point I was trying to make was about this quote: > This is useful since it can remove the need for some servers to have any outbound internet access at all. My point is that if you are not connected to the public internet at all I don't see…

I understand you now.

I suppose the argument is you're building a house without a door. While you may believe you have everything you will ever need in that house, there's a likelyhood you will eventually need to leave (or something needs to arrive). Now you're stuck. Of course, it's not all or nothihng when it comes to IP space.

If you were going to use 11.x for an air gapped secure enclave, I would have a very difficult time presenting a scenario where that may bite you later. However, I'd vote to use CGNAT reserved space before any 'unused' public IP space.

Re: Who is squatting IPv4 addresses?

#44

Post by thedougd »

jcims wrote: post #28
thedougd wrote: post #6

Earlier quoted context omitted.

That's not really what the author was getting at. The VPC endpoints just provide a way (via TLS certificate authority logs) for the author to discover DNS addresses that they can then use to check for queries and determine what IP addresses are being used in private networks. They found a number of AWS users that are treating publicly routable IP space as their own private IP space. If someone were to ever offer a pu…

This is useful threat intel as well b/c many firms employ source ip address in policy constraints and log monitoring. However it's trivial to masquerade as a target IP address range in a private vpc, and overlap could indicate that someone is up to some tomfoolery. (FWIW cloudtrail will include source vpc and/or vpc endpoint information when the request is coming through an endpoint. This will help detect those reque…

And you can use IAM policies with VPC endpoints!

I wish AWS would offer an all-in-one VPC endpoint that covered all their services. Of course they're not financially incentivized to do that.

Re: Who is squatting IPv4 addresses?

#45

Post by KennyBlanken »

xoa wrote: post #37
emilecantin wrote: post #14

About 10 years ago, IBM used to use the 9.0.0.0/8 space in basically exactly the same way as one would use 10.0.0.0/8, for internal-only networking. Each workstation got its own 9.x.x.x IP, but it wasn't routable from outside. I hope they stopped doing that, but I doubt it.

Why would that be relevant here (or sibling comment about Apple)? Last I checked except for 9.9.9.0/24 (to quad9) IBM is indeed the assignee for 9.0.0.0/8 from back in 1992. Apple got 17.0.0.0/8 back in 1990. Back in the day a lot of big entities got whole /8 blocks (including of course a lot of the USG but private corps as well). Many of them are still around and fully active, while others are defunct (Halliburton h…

Of a highly constrained resource, they're using a tiny fraction of what they've been given. That's a weird definition of "using what they have."

If I asked for a class C for my business running a local corner store, I'd be looked at like I was crazy.

IBM gets 16 million public IPs and it's cool?

Yeah, I know you can't perfectly use an IP space, but with 128 offices, IBM could give each office an allocation of around a hundred thousand IP addresses (rounding down by over 20%. But even if it were 10,000 - that's still absurd.)

Re: Who is squatting IPv4 addresses?

#47

Post by Godel_unicode »

hotpotamus wrote: post #32
kevincox wrote: post #2

One minor philosophical question. If you are using AWS PrivateLink because your VPC is not connected to the internet are you really squatting anything? You are just aren't using the public internet. This means that you own the entire address space and can decide what you want to do with it. Of course it still may make sense to stick to ranges you own in case you need to peer your VPC with someone else, but I don't se…

I believe the networking term is "bogon". Basically you're using space in a way that isn't intended. Mostly I've seen it as people trying to use RFC1918 space on public networks probably because of misconfigurations and most routers/FWs will ignore these. This is sort of the inverse.

Not really, bogon is generally used for either unallocated space or "Martian" packets (packets with a source in private space). This space is unannounced, but not unallocated, therefore it doesn't show up on the bogon list.

Here's the team cymru bogon list, for instance: https://team-cymru.com/community-services/bogon-reference/bo...

Re: Who is squatting IPv4 addresses?

#48

Post by thetinguy »

xoa wrote: post #37
emilecantin wrote: post #14

About 10 years ago, IBM used to use the 9.0.0.0/8 space in basically exactly the same way as one would use 10.0.0.0/8, for internal-only networking. Each workstation got its own 9.x.x.x IP, but it wasn't routable from outside. I hope they stopped doing that, but I doubt it.

Why would that be relevant here (or sibling comment about Apple)? Last I checked except for 9.9.9.0/24 (to quad9) IBM is indeed the assignee for 9.0.0.0/8 from back in 1992. Apple got 17.0.0.0/8 back in 1990. Back in the day a lot of big entities got whole /8 blocks (including of course a lot of the USG but private corps as well). Many of them are still around and fully active, while others are defunct (Halliburton h…

Apple is definitely still using it.
Post reply on HN