6 ms·
Did AS8003 just disappear?
- themodelplumber 5y ago> Once again as a final note: your corporate network may be using the formerly unused DoD space internally, and if so, there is a risk you could be leaking it out to a party that is actively collecting it. How could you know? Using Kentik’s Data Explorer, you could quickly and easily view the stats of exactly how much data you’re leaking to AS8003 (now AS749). May be worth a check, and if so, start a free trial of Kentik to do so. Not that I don't appreciate the free trial offer. But before getting into data characteristics, I'm curious which addresses should be examined in a cursory internal look-see?
- Lammy 5y agohttps://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks#List_of_assigned_/8_blocks_to_the_United_States_Department_of_Defense https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
- 0x0000000 5y ago11.0.0.0/8
- themodelplumber 5y agoThank you
- bogomipz 5y agoWas it ever common to use 11/8 internally? Did people just roll dice because it wasn't being announced? The reference in the post is the first I've heard of people possibly using it.
- imglorp 5y agoI'm baffled too. This is why there is an RFC 1918 so everyone knows what's public and private.
- jart 5y agoThere's probably some group of network operators out there who decided amongst themselves that it'd be cheaper and easier to squat the dod ranges when shuffling traffic amongst themselves, than having to wrap each packet with a tunneling header. Or who knows maybe some third world dictator told their isps to use the dod ranges because they mistakenly assumed it would isolate their nation's traffic from the rest of the world. It's a real shame that the linked article doesn't divulge what's actually happening. The DOD owns all IPs starting with 6, 7, 11, 21, 22, 26, 28, 29, 30, 33, 55, 214, and 215. To a network operator who spends his day filling out forms explaining why he needs each and every /32 I imagine it must make you feel like someone who spends half his income to live in a tiny crumby apartment in a city surrounded by vacant unsecured mansions. The owners of these mansions haven't set foot in them for thirty years. So surely it must be safe to just move in right?
- Dylan16807 5y agoI was going to suggest 240 and up but apparently Windows will flat-out reject those addresses for any use.
- bradknowles 5y agoWait. One of my last actions as the DISA.MIL Technical POC was to turn one of those Class-A network ranges back into the NIC. I thought it was 21/8? You mean they never actually turned that one back in? Dang it! I thought that was one of my minor successes during my time in that role. ;(
- mike_d 5y ago49/8 and 50/8 were returned by DoD in the late 90s if that is what you are thinking of.
- 5y ago
- 300bps 5y agoNo
- Bluecobra 5y agoI once worked at a place that used 100.0.0.0/8. At the time that range was not in use on the Internet. Not sure if that was intentional or a fat finger. That place was ran by idiots though, so it was probably the latter.
- gfv 5y agoDo you mean 100/8 other than the 100.64.0.0/10 RFC6598 CGNAT range?
- tbyehl 5y agoSquatting on DoD / MoD ranges is rampant. Rogers and T-Mobile have done it. My employer squats on... another popular range... for a secondary non-routed network. They can't be bothered to egress filter it on the primary routed network so we sometimes have misconfigured systems trying to ship data off to random servers on another continent.
- zamadatix 5y agoIf you're going to look for one such risk you might as well look for them all - if it's public space and you don't own it you should get off it regardless what isn't advertised on the internet today.
- baxtr 5y ago> The message above has a timestamp of 16:57 UTC (11:57am ET) on January 20, 2021, moments after the swearing in of Joe Biden as the President of the United States and minutes before the statutory end of the administration of Donald Trump at noon Eastern time. The questions that started to surface included: Who is AS8003? Why are they announcing huge amounts of IPv4 space belonging to the U.S. Department of Defense? And perhaps most interestingly, why did it come alive within the final three minutes of the Trump administration? From the linked article on top, as background info. Quite interesting. https://www.kentik.com/blog/the-mystery-of-as8003/ https://www.kentik.com/blog/the-mystery-of-as8003/
- greyface- 5y agoRelated thread: https://news.ycombinator.com/item?id=26924883 https://news.ycombinator.com/item?id=26924883
- motohagiography 5y agoWas going to ask if this was related to that story. I had thought it was announcing space to gather some kind of intelligence about traffic to those networks, or do an attack on the tor network by providing it all as exit nodes. I also speculated that it's possible it has to do with some kind of internal policy where if you don't use address space in a certain period of time, you lose it or it must be sold, and announcing it created a record of it being in use. Depending on for how long it was announced, the captured one-way traffic to it would provide a snapshot sample of source-dest relationships in that address space for a map. It could also have just been used as an internal DoD ASN and it got leaked and announced by mistake, with all those routes redistributed into the announcement, though we'd have to look at the data to really recognize that error. A political hypothesis was fun, but unless it yielded evidence of some underlying activity, there seem like other explanations that could indicate the cause.
- chaimanmeow 5y ago> However, despite the new origin (AS749) these prefixes are still routed exclusively through Hurricane Electric (AS6939) sounds pretty familiar.
- betaby 5y agoNot a popular idea here, but IPv6 folks. Even for k8s, even for your internal stuff.
- zhte415 5y agoWhy is IPv6 not a popular idea here?
- eppp 5y agoI work at an ISP and not a single customer has ever even mentioned IPv6. There zero demand on the residential side.
- mgarfias 5y agoI’ve begged my isp to get on it
- eppp 5y agoI just got a /32 from ARIN to start implementing it on our network but it is by no stretch of the imagination worth the effort. I will probably have at least 40 hours into testing it and no increased revenue will be realized by it. Maybe IPv6 was the the right thing to due but the practical implementation is ridiculous.
- toast0 5y agoI doubt you'll see more revenue from it. If you're low on v4 addresses and you're willing to put (some) subscribers behind CGNAT, then inplementing v6 should reduce the number of v4 addresses you need and thus reduce your costs. If you give each subscriber an IPv4, then yeah, added operational cost, no revenue, maybe added capital cost depending on your equipment. Not much upside for a small ISP. In a competitive market, v6 can get you some points with the technical folks, but not many.
- kalleboo 5y ago
- lostmsu 5y agoOpened this from RSS feed, because I thought AS8003 is a name of a star or a galaxy.
- superdisk 5y agoI figured it was the name of an assembler for a processor called the 8003.
- DaiPlusPlus 5y agoI thought it was a flight number and we were about to be hit with months of world news headlines into the investigations of a flight that simply disappeared.
- AnIdiotOnTheNet 5y agoNow it's a twilight zone episode: flight AS8003 disappears over the Atlantic, simultaneously star AS8003 vanishes from the night sky, and every copy of the AS8003 assembler ceases to exist on all media.
- ctdonath 5y agoProof of The Simulation, and that it suffers "bit rot" too.
- Turing_Machine 5y agoYeah, me too. AS = Alaska Airlines, which I fly on semi-regularly.
- marricks 5y agoI opened it from the site and thought that :(
- fourtrees 5y agoI thought it was about the A380's retirement for a few seconds.
- cobaltoxide 5y agoCame here because I thought maybe AS8003 was another disappearing aircraft like MAS370.
- mlindner 5y agoI'm surprised kentik is still around. They were selling an inferior product to a company I worked at that was bought by Nokia. I figured they would've gone out of business by now.
- usr1106 5y agoNobody wonders why Microsoft is still around. Selling a technically inferior product is not a problem if you can find customers. There can be many reasons. Markets are far from perfect.
- guerrilla 5y agoI wonder if the spammers at Global Resource Systems LLC were just covert ops mapping the email space rather than IP.
- BTCOG 5y ago>Article about AS8003 Entire comment thread is irrelevant bikeshedding.
- drwhaterever 5y agoIts all Russia guys, don't you understand the relationship between trump and Putin. If that isn't enough just look at what trump was doing to DoD during his last days in office. He fire a lot of people so that he can install lobbyists. This was planned.