IPv4 Free Pool Drops Below 10%, 1.0.0.0/8 Allocated 467
Posted
by
kdawson
from the pure-water dept.
from the pure-water dept.
mysidia writes "A total of 16,777,216 IP address numbers were just allocated to the Asian Pacific Network Information Centre IP address registry for assignment to users. Some venerable IP addresses such as 1.1.1.1 and 1.2.3.4 have been officially assigned to the registry itself temporarily, for testing as part of the DEBOGON project. The major address blocks 1.0.0.0/8 and 27.0.0.0/8, are chosen accordance with a decision by ICANN to assign the least-desirable remaining IP address ranges to the largest regional registries first, reserving most more desirable blocks of addresses for the African and Latin American internet users, instead of North America, Europe, or Asia. In other words: of the 256 major networks in IPv4, only 24 network blocks remain unallocated in the global free pool, and many of the remaining networks have been tainted or made less desirable by unofficial users who attempted an end-run around the registration process, and treated 'RESERVED' IP addresses as 'freely available' for their own internal use. This allocation is right on target with projected IPv4 consumption and was predicted by the IPv4 report, which has continuously and reliably estimated global pool IP address exhaustion for late 2011 and regional registry exhaustion by late 2012. So, does your enterprise intranet use any unofficial address ranges for private networks?" Reader dude_nl sends in a summary of the issues with allocating from 1.0.0.0/8 from the BGPmon.net blog. "As Alain Durand mentioned on Nanog: 'Who said the water at the bottom of the barrel of IPv4 addresses will be very pure? We ARE running out and the global pain is increasing.'"
AnoNet (Score:5, Informative)
AnoNet [wikipedia.org] is one of those who use 1.0.0.0/8 for private VPN because everyone thought it wouldn't be in use. I am pretty sure there are A LOT of organizations and other services who do too.
anoNet is a decentralized friend-to-friend network built using VPNs and software BGP routers. anoNet works by making it difficult to learn the identities of others on the network allowing them to anonymously host content and IPv4 services. Assuming that a router administrator on such a metanet knows only information about the adjacent routers, standard routing protocols can take care of finding the proper path for a packet to take to reach its destination. All destinations further than one hop can for most people's threat models be considered anonymous. This is because only your immediate peers know your IP. Anyone not directly connected to you only knows you by an IP in the 1.0.0.0/8 range, and that IP is not necessarily tied to any identifiable information.
To avoid addressing conflict with the internet itself, the range 1.0.0.0/8 is used. This is to avoid conflicting with internal networks such as 10/8, 172.16/12 and 192.168/16, as well as assigned Internet ranges. As of January 2010 IANA has allocated 1/8 to APNIC.[1] If the service does not switch to another address range then Internet hosts using 1.0.0.0/8 will be inaccessible to AnoNet users.
Re:What about getting back some... (Score:5, Informative)
And for each of those /8s, you buy maybe 1.5-2 months more time until v4 exhaustion. Most of those /8s were also allocated prior to any policies permitting reclamation. Any recovery of them would involve legal wrangling, which would be expensive and time consuming. Prolonging the end result isn't a viable solution to the problem, when the solution is available now.
Re:AnoNet (Score:5, Informative)
Uhhhh...no?
10.0.0.0/8 is, and always will be, an RFC-1918 private IP address used for internal networks and NAT.
The company in question was using 1.0.0.0/8, just because it was routable and unused.
Re:Desirable? (Score:5, Informative)
A good example of an undesirable IP address is one that's on a bunch of spam blacklists.
Some IP addresses are more likely to have connectivity issues than others.
One major issue improper or poorly maintained filters, that effects most address blocks that were previously not being assigned from equally, hence the DEBOGON projects and testing.
There are more insidious issues that only effect some blocks, however.
For example the guerilla usage of "1.0.0.0/8" by AnoNet, and "5.0.0.0/8" by Hamachi, plus private use of those, and other ranges instead of proper RFC1918 addresses by some enterprises.
Makes hosts that use those IP addresses more likely to have communication problems with other hosts on the internet, just because their IP address is in that block.
Re:AnoNet (Score:1, Informative)
Just to be clear: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 are officially assigned [faqs.org] for use by private networks. They cannot be allocated for use on the internet.
And "192.0.0.0/24" has been allocated for use in documentation, so those 256 addresses won't be allocated for use on the internet, either.
Re:AnoNet (Score:2, Informative)
Another one still unallocated is 5.0.0.0/8 which Hamachi uses to create a virtual lan on the internet. I'm sure it wont be too long until that one will get assigned too though.
Also some Cisco hardware use 1.1.1.1 internally. Painful times ahead.
Re:Install your own 6to4 tunnel today (Score:4, Informative)
Only problem is this does not work with NAT.
To be clear, 6to4 needs to be run on the device with your public IP address, or alternately that device needs to pass protocol 41 traffic to the machine doing 6to4. The rest of your network then gets access by native IPv6 routing.
The presence of NAT is not fatal to 6to4.
Re:Ill bet this will happen (Score:3, Informative)
Not just any modern OS, the BSDs, *nixes, and Windows all have IPv6 support going back a decade. I'm not sure about the classic Mac OS, though.
Re:Multicast/Class E (Score:4, Informative)
The problem with "Class E" is these addresses have a "not a valid IP address" status; the classification of the addresses are "Experimental", not UNICAST. As a result, many OSes or devices from many vendors will not allow you to assign a Class E address, or communicate with a Class E address.
Windows XP falls into that category, Vista falls into that category, I cannot confirm whether Windows 7 falls into the category or not; unless there has been a recent patch, Class E IPs are unusable. Even Linux wouldn't allow you to communicate with a Class E address or assign it to an interface, until a kernel patch that was first introduced in January 2008
Many routers and firewalls are in a similar situation. There is a lot of old software running at internet sites that is unlikely to be updated.
If "Class E" address space is ever opened, it's likely that IETF would not direct IANA to assign Class E to the RIRs for public allocation, instead it might be made available for private purposes, much like the RFC1918 address space.
The possibility of allocating 240/4 for use has been discussed on various network engineering mailing lists.
Their findings were that many software programs and hardware devices recognize "Class E" addresses and indicates an error.
So the thought that "Class E" is just more IP addresses to pick up for free, is a nice idea, but unfortunately no panacea. It would be very hard to resurrect that range to 'usefulness' at this point in the Internet's evolution (with such a large installed base).
Re:Unfortunately, applications still behind the cu (Score:5, Informative)
among the software I use, the following don't support v6 at all
Please file bugs. Most Free Software projects take IPv6 very seriously indeed.
Re:How's NAT64 coming along? (Score:5, Informative)
NAT between v4 and v6 has been deprecated.
The solution is dual stack. Each machine will have both a v4 and a v6 address. The v4 address will be subject to NAT. The v6 will be used because you need it for peer to peer traffic such as voice over IP.
People without dual stack will be in for a hard awakening the day servers start appearing with only v6 because they couldn't afford a v4.
The end is near (Score:3, Informative)
We are going to run out of IPv4 addresses in March next year (422 days from today) /JB
http://ipv4depletion.com/?page_id=4 [ipv4depletion.com]
Re:reclaim dead ip space first (Score:2, Informative)
I don't know of ARIN ever handing out a /8.
ARIN and the RIRs did not exist until 1997. Prior to that date it was Network Solutions in the 90s, and prior to that it was IANA itself.
Before CIDR, the size of address blocks that organizations needed was different than today.
The policy was also different.
When ARIN was formed, one of the conditions they had to agree to in order to take on the role was to continue to service the existing allocations under the same terms.
The legacy registrants have held, since their allocations were not conditional, ARIN can't impose new conditions on them, such as requiring them to pay fees, or require them to renumber/return unused addresses.
In other words... "taking away the /8" is out of ARIN's hands, unless the entity or network no longer actually exists, and you can prove that....
Re:Unfortunately, applications still behind the cu (Score:5, Informative)
In the case of NFS and MySQL, both know about it, and both are looking to fix it, but we won't see the changes any time soon (MySQL expects to see v6 support in version 6.0, and I have no idea when NFSv6 support will land). rtorrent has a patch, but it isn't in stable yet, and I inquired on the m0n0wall mailing list, but alas, received only radio silence. As for MythTV, there's absolutely no mention of v6 anywhere, aside from a stub page on their wiki, so I'm not sure it's even on their radar (though you're right, I should inquire).
Re:Unfortunately, applications still behind the cu (Score:5, Informative)
Uh, no, not at all. To resolve v6 hostnames, you have to retrieve AAAA DNS records instead of A records. That's an application-level activity. Once a v6 address is chosen, the application must be written to create a v6 socket from that address.
Now, it's true that higher-level APIs can hide these details (I believe Java applications are automatically v6 aware thanks to the higher-level APIs exposed by the JDK), but applications written against POSIX must be explicitly written to support v6.
Re:AnoNet (Score:2, Informative)
AnoNet [wikipedia.org] is one of those who use 1.0.0.0/8 for private VPN because everyone thought it wouldn't be in use. I am pretty sure there are A LOT of organizations and other services who do too.
Well that would be their own fault for not using an address like 10.0.0.0/8 which was designed and documented for that purpose.
Re:Is this a misprint... (Score:2, Informative)
ISI.EDU is no longer DoD contracter for the IANA function.
ICANN is the current holder of the USG contract for the IANA function.
Many of IANA's roles were stripped from it and assigned to other entities which makes sense.
Still, it is perhaps among the saddest moments in internet history, that this change happened...
Good and bad things have come of it. But don't think of IANA as a separate entity anymore, it's really just ICANN.
Re:AnoNet (Score:4, Informative)
Well that would be their own fault for not using an address like 10.0.0.0/8 which was designed and documented for that purpose.
You know, it really wouldn't hurt to read a post before you reply to it...
To avoid addressing conflict with the internet itself, the range 1.0.0.0/8 is used. This is to avoid conflicting with internal networks such as 10/8, 172.16/12 and 192.168/16, as well as assigned Internet ranges. As of January 2010 IANA has allocated 1/8 to APNIC.[1] If the service does not switch to another address range then Internet hosts using 1.0.0.0/8 will be inaccessible to AnoNet users.
Re:Ill bet this will happen (Score:3, Informative)
I'd probably say china's 1 child/family policy was a proactive policy to prevent an overpopulation problem in china. Can you imagine such a policy in the west? I'm not saying it is good or bad, just a difference. Generally I'd say democratic societies have a very hard time making difficult choices until there is no other possible option. Centralized govt on the other hand can cram a decision down the people with no fear of not being re-elected. Uprising maybe, but thats what good armies are for.
Re:Install your own 6to4 tunnel today (Score:5, Informative)
Or do a Google search for "jeroen sixxs". You'll hit the motherlode, including these gems (among many):
http://en.linuxreviews.org/SixXS [linuxreviews.org]
http://www.koopman.me/2008/04/stay-away-from-sixxs-run-by-a-couple-kids/ [koopman.me]
https://rejo.zenger.nl/misc/1221048210.php [zenger.nl]
Re:No (Score:3, Informative)
Lookup each octect in a ascii table (as a decimal) and it reads F.U.C.K
Re:Better Reserve 1.1.1.0/24 :-) (Score:2, Informative)
I'm told, by sources that are usually authoritative enough that I'm going to be lazy and not go find the original references (:-), that APNIC has in fact done the right thing and reserved several commonly-misused subnets of 1/8 and 27/8. Slashdot won't let me quote the actual table because it has too many "'junk' characters", but they did 1.0.0.0/24, 1.1.1.0/24, 1.2.3.0/24, 1.50.0.0/22, 1.255.0.0/16.
Re:No (Score:3, Informative)
You can start using 8.8.8.8 and 8.8.4.4 for public dns (and ping too if you wish), they are Google's and they are not going to lock those down anytime soon.