Tuesday, March 5, 2013

The networks you don't want

This might be a bit of old news, but hopefully you can avoid some troubleshooting headaches with this post.
As the shortage of IPv4 addresses increased, IANA reclassified several /8 networks from "Reserved" to "Unallocated" around 2008 and started allocating them to RIRs in the following years. In the recent year or two the RIRs have begun to allocate them to their LIRs and they have begun to allocate them to their users.
The networks in question are 1.0.0.0/8, 2.0.0.0/8, 5.0.0.0/8, 23.0.0.0/8, 27.0.0.0/8, 31.0.0.0/8, 36.0.0.0/8, 37.0.0.0/8, 39.0.0.0/8, 42.0.0.0/8, 100.0.0.0/8-113.0.0.0/8, 173.0.0.0/8-185.0.0.0/8, 197.0.0.0/8 and 223.0.0.0/8.

This has caused some issues on the Internet, which can be divided into 3 categories: "Existing traffic", "Other uses" and "Security".

The issue with existing traffic was investigated, when APNIC was assigned the 1.0.0.0/8 network. Before they started assigning it to their LIRs, they found out, that on average 160Mbps of traffic to this network existed, with bursts of up 850 Mbps. Now, one might think, that there is always some traffic to any unallocated network on the Internet, so they also made a benchmark against one of their existing unallocated networks. For this network an average of 10 Kbps traffic existed, with hardly any traffic above 100 Kbps. It's not clear what this traffic is, but it's most likely leakage from private networks.

The second issue "Other uses" became very real for users of Hamachi in 2012. They where using the 5.0.0.0/8 network for their VPN service. Once real 5/8 addresses started showing up on the Internet in June 2012, this service stopped working properly and users had to change their network setup.

The final issue is the one found in the security of some network devices like routers and firewalls. Many devices have a bogon list, which automatically filters out unwanted addresses. These are either blocked or not routed. When the bogon list isn't up to date the devices are blocking legal traffic.

The biggest issue of the above is the last one. This can potentially block users from accessing certain sites on the Internet, which in turn gives the user a bad experience and generates less traffic on the site.

What can you do?
Whether or not you have been assigned these addresses you should check your own network equipment, especially firewalls, for bogon lists. Most equipment comes with a predefined list from the vendor and most vendors update their lists with new software releases. Even if you update the software you should check against the currently allocated addresses, which can be found on the IANA website. Any lists, you have created yourself, must always bee kept up to date with the IANA list. This shouldn't be a big task, since IANA has no more addresses to allocate.
If you have been assigned a previously reserved address space, you should use them carefully. Before you even start using them, try to allocate them on a PC and dump the incoming traffic. If you get a lot of traffic (above 100 Kbps), you should contact the ISP or upstream, who is sending you the traffic and tell them, that someone is using your IP space.
Wherever possible you should use these addresses for infrastructure. Try to avoid using them where end-users would get them assigned, either directly or indirectly, on endpoints. You could use them in your VoIP infrastructure but should avoid using them on PCs or for NAT. If you still need to use them for theses purposes and you encounter sites, which you can't access, the only option you have is to contact that site and ask them to check their network setup for bogon lists, since this is the most likely cause of the problem. Unfortunately some sites use low quality firewalls, where the vendor either doesn't update the bogon list or where the administrator can't or doesn't know who to turn it off. It can often be difficult to explain the problem to these administrators and the best argument you can use, is that they are loosing out on a lot of traffic, because they are unintentionally blocking millions of users.