Mailing List Archive

Hi,

On lun. 4 nov. 10:55:47 2019, Chris Knipe wrote:
> Hi Guys,
>
> Except for the email on ARIN's details, does anyone else have a contact for
> the DoD?
>
> We are experiencing a situation with a 3rd party (direct peer), wanting to
> advertise DoD address space to us, and we need to confirm whether they are
> allowed to do so or not.
>
> Range in question is the 22.0.0.0/8 network, which according to ARIN is
> actively assigned to the DoD (US).

There is no route inside this /8:
bird> show route primary where net ~ [ 22.0.0.0/8+ ]
bird>

Regards,
--
Alarig

maybe a typo, start from 23/8 not 22/8

________________________________
From: NANOG <nanog-bounces@nanog.org> on behalf of Chris Knipe <savage@savage.za.org>
Sent: Monday, November 4, 2019 4:55:47 PM
To: nanog list <nanog@nanog.org>
Subject: DoD IP Space

Hi Guys,

Except for the email on ARIN's details, does anyone else have a contact for the DoD?

We are experiencing a situation with a 3rd party (direct peer), wanting to advertise DoD address space to us, and we need to confirm whether they are allowed to do so or not.

Range in question is the 22.0.0.0/8<http://22.0.0.0/8> network, which according to ARIN is actively assigned to the DoD (US).

--

Regards,
Chris Knipe

On Mon, Nov 4, 2019 at 11:20 AM Alarig Le Lay <alarig@swordarmor.fr> wrote:

>
> There is no route inside this /8:
> bird> show route primary where net ~ [ 22.0.0.0/8+ ]
> bird>
>
> Regards,
> --
> Alarig
>


I know that much - but just because it's not advertised, doesn't mean
you're allowed to use it?

It's not a typo either - the net in question is 22/8 -
https://whois.arin.net/rest/net/NET-22-0-0-0-1/pft?s=22.0.0.0%2F8

It's directly assigned space, I can't find any reference anywhere about
subnets within that space that has been re-assigned, or that is in use by
anyone else.

--

Regards,
Chris Knipe

On 04/11/2019 10:23, Chris Knipe wrote:
> I know that much - but just because it's not advertised, doesn't mean
> you're allowed to use it?  

It means that you’re not supposed to advertise it to your peers, at least.

The usage of public-but-not-used space inside networks isn’t really my
problem as long as it’s not mine (and I never did something like this).

--
Alarig

On Mon, Nov 04, 2019 at 10:55:47AM +0200,
Chris Knipe <savage@savage.za.org> wrote
a message of 35 lines which said:

> We are experiencing a situation with a 3rd party (direct peer),
> wanting to advertise DoD address space to us, and we need to confirm
> whether they are allowed to do so or not.

The US military lacks money and sold parts of 22/8, like the radio
amateurs? :-) Apparently, no part of it ever appeared on the Internet.

22/8 is actively used by DoD, just not publicly. It would be in your best
interest to not accept routes for it.

if you need something more official, contact the DoD NIC directly at the
email address specified in WHOIS.

On Mon, Nov 4, 2019 at 3:32 AM Stephane Bortzmeyer <bortzmeyer@nic.fr>
wrote:

> On Mon, Nov 04, 2019 at 10:55:47AM +0200,
> Chris Knipe <savage@savage.za.org> wrote
> a message of 35 lines which said:
>
> > We are experiencing a situation with a 3rd party (direct peer),
> > wanting to advertise DoD address space to us, and we need to confirm
> > whether they are allowed to do so or not.
>
> The US military lacks money and sold parts of 22/8, like the radio
> amateurs? :-) Apparently, no part of it ever appeared on the Internet.
>


--
Jason

On Mon, Nov 4, 2019 at 3:13 PM Jason Biel <jason@biel-tech.com> wrote:

> 22/8 is actively used by DoD, just not publicly. It would be in your best
> interest to not accept routes for it.
>
> if you need something more official, contact the DoD NIC directly at the
> email address specified in WHOIS.
>
>
Precisely what I was afraid off. I have contacted the DoD NIC, am waiting
for a response from them.

Thank you Jason,

Chris.

On 2019-11-04 13:33, Chris Knipe wrote:
> On Mon, Nov 4, 2019 at 3:13 PM Jason Biel <jason@biel-tech.com> wrote:
>
>> 22/8 is actively used by DoD, just not publicly. It would be in your
>> best interest to not accept routes for it.
>>
>> if you need something more official, contact the DoD NIC directly at
>> the email address specified in WHOIS.
>
> Precisely what I was afraid off. I have contacted the DoD NIC, am
> waiting for a response from them.
>
> Thank you Jason,
>
> Chris.

On the off chance that they read this thread, I'm curious if they are
aware of 7.7.7.0/24.

https://stat.ripe.net/7.7.7.0%2F24#tabId=routing

Rob

Yeah, check with the DoD NIC 100% of the time. Probably a pretty safe bet
that unless they are a US government agency, they're not authorized.

For anyone who did not attend NANOG last week, representatives from NCIS
and the FBI reminded the audience in no uncertain terms that "industry
standard squat space" does not exist. If you're 'borrowing' DoD space, hope
you don't get caught doing so. :)

On Mon, Nov 4, 2019 at 8:35 AM Chris Knipe <savage@savage.za.org> wrote:

>
>
> On Mon, Nov 4, 2019 at 3:13 PM Jason Biel <jason@biel-tech.com> wrote:
>
>> 22/8 is actively used by DoD, just not publicly. It would be in your best
>> interest to not accept routes for it.
>>
>> if you need something more official, contact the DoD NIC directly at the
>> email address specified in WHOIS.
>>
>>
> Precisely what I was afraid off. I have contacted the DoD NIC, am waiting
> for a response from them.
>
> Thank you Jason,
>
> Chris.
>
>

On Mon, Nov 04, 2019 at 10:55:47AM +0200, Chris Knipe wrote:
> Hi Guys,
>
> Except for the email on ARIN's details, does anyone else have a contact for
> the DoD?
>
> We are experiencing a situation with a 3rd party (direct peer), wanting to
> advertise DoD address space to us, and we need to confirm whether they are
> allowed to do so or not.

A signed ROA would be strong attestation. Anything else is
suspect.

> Range in question is the 22.0.0.0/8 network, which according to ARIN is
> actively assigned to the DoD (US).

Of timely reference was this presentation from last Monday
by some USG folks who have a keen interest in address
hijacking. Unfortunatelky not recorded, but slide 11 has
some interested parties and points of contact.

https://pc.nanog.org/static/published/meetings/NANOG77/2108/20191028_Elverson_Your_As_Is_v1.pdf

Cheers,

Joe

--
Posted from my personal account - see X-Disclaimer header.
Joe Provo / Gweep / Earthling

Hi Everyone,

Thank you very much for all the information, suggestions, and feedback.

We have been contacted by the NCIS now, and will be discussing the matter
further with them.

I don't think I'm comfortable, or feel it is justified, to discuss this
matter further publicly. I now find myself in the absolute last situation
where I wanted to be in.

Regards,
Chris.


On Mon, Nov 4, 2019 at 4:44 PM Joe Provo <nanog-post@rsuc.gweep.net> wrote:

> On Mon, Nov 04, 2019 at 10:55:47AM +0200, Chris Knipe wrote:
> > Hi Guys,
> >
> > Except for the email on ARIN's details, does anyone else have a contact
> for
> > the DoD?
> >
> > We are experiencing a situation with a 3rd party (direct peer), wanting
> to
> > advertise DoD address space to us, and we need to confirm whether they
> are
> > allowed to do so or not.
>
> A signed ROA would be strong attestation. Anything else is
> suspect.
>
> > Range in question is the 22.0.0.0/8 network, which according to ARIN is
> > actively assigned to the DoD (US).
>
> Of timely reference was this presentation from last Monday
> by some USG folks who have a keen interest in address
> hijacking. Unfortunatelky not recorded, but slide 11 has
> some interested parties and points of contact.
>
>
> https://pc.nanog.org/static/published/meetings/NANOG77/2108/20191028_Elverson_Your_As_Is_v1.pdf
>
> Cheers,
>
> Joe
>
> --
> Posted from my personal account - see X-Disclaimer header.
> Joe Provo / Gweep / Earthling
>


--

Regards,
Chris Knipe

On 11/4/19 1:55 AM, Chris Knipe wrote:
> We are experiencing a situation with a 3rd party (direct peer), wanting
> to advertise DoD address space to us, and we need to confirm whether
> they are allowed to do so or not.

That sounds like someone is squatting on DoD IP space, likely for
something like CGN and (hopefully inadvertently) wanting to advertise it
to you.

This thread got me to wondering, is there any legitimate reason to see
22/8 on the public Internet? Or would it be okay to treat 22/8 like a
Bogon and drop it at the network edge?



--
Grant. . . .
unix || die

On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG <nanog@nanog.org> wrote:
> This thread got me to wondering, is there any legitimate reason to see 22/8 on the public Internet? Or would it be okay to treat 22/8 like a Bogon and drop it at the network edge?

Given the transfer market for IPv4 addresses, the spot price for IPv4 addresses, and the need of even governments to find “free” (as in unconstrained) money, I’d think treating any legacy /8 as a bogon would not be prudent.

Regards,
-drc

Peace,

On Tue, Nov 5, 2019, 4:55 PM David Conrad <drc@virtualized.org> wrote:
> On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG <nanog@nanog.org> wrote:
>> This thread got me to wondering, is there any
>> legitimate reason to see 22/8 on the public
>> Internet? Or would it be okay to treat 22/8
>> like a Bogon and drop it at the network edge?
>
> Given the transfer market for IPv4 addresses,
> the spot price for IPv4 addresses, and the need
> of even governments to find “free” (as in
> unconstrained) money, I’d think treating any
> legacy /8 as a bogon would not be prudent.

It has been said before in this thread that the DoD actively uses this
network internally. I believe if the DoD were to cut costs, they
would be able to do it much more effectively in many other areas, and
their IPv4 networks would be about the last thing they would think of
(along with switching off ACs Bernard Ebbers-style). With that in
mind, treating the DoD networks as bogons now makes total sense to me.

--
Töma

Using the generally accepted definition of a bogon ( RFC 1918 / 5735 /
6598 + netblock not allocated by an RiR ), 22/8 is not a bogon and
shouldn't be treated as one.

The DoD does not announce it to the DFZ, as is their choice, but nothing
says they may not change that position tomorrow. There are plenty of
subnets out there that are properly allocated by an RiR, but the assignees
do not send them to the DFZ because of $reasons.

In my opinion, creating bogon lists that include allocated but not
advertised prefixes is poor practice that is likely to end up biting an
operator at one point or another.

On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov <ximaera@gmail.com> wrote:

> Peace,
>
> On Tue, Nov 5, 2019, 4:55 PM David Conrad <drc@virtualized.org> wrote:
> > On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG <nanog@nanog.org>
> wrote:
> >> This thread got me to wondering, is there any
> >> legitimate reason to see 22/8 on the public
> >> Internet? Or would it be okay to treat 22/8
> >> like a Bogon and drop it at the network edge?
> >
> > Given the transfer market for IPv4 addresses,
> > the spot price for IPv4 addresses, and the need
> > of even governments to find “free” (as in
> > unconstrained) money, I’d think treating any
> > legacy /8 as a bogon would not be prudent.
>
> It has been said before in this thread that the DoD actively uses this
> network internally. I believe if the DoD were to cut costs, they
> would be able to do it much more effectively in many other areas, and
> their IPv4 networks would be about the last thing they would think of
> (along with switching off ACs Bernard Ebbers-style). With that in
> mind, treating the DoD networks as bogons now makes total sense to me.
>
> --
> Töma
>

Tom –

Most definitely: lack of routing history is not at all a reliable indicator of the potential for valid routing of a given IPv4 block in the future, so best practice suggest that allocated address space should not be blocked by others without specific cause.

Doing otherwise opens one up to unexpected surprises when issued space suddenly becomes more active in routing and is yet is inexplicably unreachable for some destinations.

/John

> On Nov 5, 2019, at 10:38 AM, Tom Beecher <beecher@beecher.cc> wrote:
>
>
> Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be treated as one.
>
> The DoD does not announce it to the DFZ, as is their choice, but nothing says they may not change that position tomorrow. There are plenty of subnets out there that are properly allocated by an RiR, but the assignees do not send them to the DFZ because of $reasons.
>
> In my opinion, creating bogon lists that include allocated but not advertised prefixes is poor practice that is likely to end up biting an operator at one point or another.
>
>> On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov <ximaera@gmail.com> wrote:
>> Peace,
>>
>> On Tue, Nov 5, 2019, 4:55 PM David Conrad <drc@virtualized.org> wrote:
>> > On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG <nanog@nanog.org> wrote:
>> >> This thread got me to wondering, is there any
>> >> legitimate reason to see 22/8 on the public
>> >> Internet? Or would it be okay to treat 22/8
>> >> like a Bogon and drop it at the network edge?
>> >
>> > Given the transfer market for IPv4 addresses,
>> > the spot price for IPv4 addresses, and the need
>> > of even governments to find “free” (as in
>> > unconstrained) money, I’d think treating any
>> > legacy /8 as a bogon would not be prudent.
>>
>> It has been said before in this thread that the DoD actively uses this
>> network internally. I believe if the DoD were to cut costs, they
>> would be able to do it much more effectively in many other areas, and
>> their IPv4 networks would be about the last thing they would think of
>> (along with switching off ACs Bernard Ebbers-style). With that in
>> mind, treating the DoD networks as bogons now makes total sense to me.
>>
>> --
>> Töma

I believe the DoD space might be a bit of a difficult one, because (correct
me if I am wrong here) due to it being so massive and unused for so long,
certain large corporations that have run out of RFC1918, etc. space
have started using it internally.

So my take on it is, don't consider it as a bogon from your upstreams, but
maybe have some questions if your downstream is attempting to announce it
as they are somewhat unlikely to be the DoD.
But if you do this, make sure you keep track of where you might have put
policies like this in, in case the DoD sells some the space or whatever in
the future.

-Cynthia


On Wed, Jan 20, 2021 at 2:39 PM John Curran <jcurran@istaff.org> wrote:

> Tom –
>
> Most definitely: lack of routing history is not at all a reliable
> indicator of the potential for valid routing of a given IPv4 block in the
> future, so best practice suggest that allocated address space should not be
> blocked by others without specific cause.
>
> Doing otherwise opens one up to unexpected surprises when issued space
> suddenly becomes more active in routing and is yet is inexplicably
> unreachable for some destinations.
>
> /John
>
> On Nov 5, 2019, at 10:38 AM, Tom Beecher <beecher@beecher.cc> wrote:
>
>
> Using the generally accepted definition of a bogon ( RFC 1918 / 5735 /
> 6598 + netblock not allocated by an RiR ), 22/8 is not a bogon and
> shouldn't be treated as one.
>
> The DoD does not announce it to the DFZ, as is their choice, but nothing
> says they may not change that position tomorrow. There are plenty of
> subnets out there that are properly allocated by an RiR, but the assignees
> do not send them to the DFZ because of $reasons.
>
> In my opinion, creating bogon lists that include allocated but not
> advertised prefixes is poor practice that is likely to end up biting an
> operator at one point or another.
>
> On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov <ximaera@gmail.com>
> wrote:
>
>> Peace,
>>
>> On Tue, Nov 5, 2019, 4:55 PM David Conrad <drc@virtualized.org> wrote:
>> > On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG <nanog@nanog.org>
>> wrote:
>> >> This thread got me to wondering, is there any
>> >> legitimate reason to see 22/8 on the public
>> >> Internet? Or would it be okay to treat 22/8
>> >> like a Bogon and drop it at the network edge?
>> >
>> > Given the transfer market for IPv4 addresses,
>> > the spot price for IPv4 addresses, and the need
>> > of even governments to find “free” (as in
>> > unconstrained) money, I’d think treating any
>> > legacy /8 as a bogon would not be prudent.
>>
>> It has been said before in this thread that the DoD actively uses this
>> network internally. I believe if the DoD were to cut costs, they
>> would be able to do it much more effectively in many other areas, and
>> their IPv4 networks would be about the last thing they would think of
>> (along with switching off ACs Bernard Ebbers-style). With that in
>> mind, treating the DoD networks as bogons now makes total sense to me.
>>
>> --
>> Töma
>>
>

Indeed.
/John

> On Jan 20, 2021, at 8:47 AM, Cynthia Revström <me@cynthia.re> wrote:
>
> But if you do this, make sure you keep track of where you might have put policies like this in, in case the DoD sells some the space or whatever in the future.

My question becomes, what level of risk are these companies taking on by
using the DoD ranges on their internal networks? And have they
quantified the costs of this outage against moving to IPv6?

Joe Klein

"inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1)
"*I skate to where the puck is going to be, not to where it has been."
-- *Wayne
Gretzky
"I never lose. I either win or learn" - Nelson Mandela


On Wed, Jan 20, 2021 at 9:06 AM John Curran <jcurran@istaff.org> wrote:

> Indeed.
> /John
>
> > On Jan 20, 2021, at 8:47 AM, Cynthia Revström <me@cynthia.re> wrote:
> >
> > But if you do this, make sure you keep track of where you might have put
> policies like this in, in case the DoD sells some the space or whatever in
> the future.
>
>

I am aware of some companies that have used parts of a DoD /8 internally to
address devices in the field that are too old to ever support IPV6. Those
devices also never interact with the public internet, and never will, so
for them, I guess the only risk would be that some other internal system
that wants to talk to those devices would not also be able to talk to any
endpoint on the public internet that wound up using space allocated from
that block, some time in the future. Is that about right or am I missing
some key failure point?

On Wed, Jan 20, 2021 at 9:59 AM j k <jsklein@gmail.com> wrote:

> My question becomes, what level of risk are these companies taking on by
> using the DoD ranges on their internal networks? And have they
> quantified the costs of this outage against moving to IPv6?
>
> Joe Klein
>
> "inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1)
> "*I skate to where the puck is going to be, not to where it has been."
> -- *Wayne Gretzky
> "I never lose. I either win or learn" - Nelson Mandela
>
>
> On Wed, Jan 20, 2021 at 9:06 AM John Curran <jcurran@istaff.org> wrote:
>
>> Indeed.
>> /John
>>
>> > On Jan 20, 2021, at 8:47 AM, Cynthia Revström <me@cynthia.re> wrote:
>> >
>> > But if you do this, make sure you keep track of where you might have
>> put policies like this in, in case the DoD sells some the space or whatever
>> in the future.
>>
>>

On 1/20/21 9:58 AM, j k wrote:
> My question becomes, what level of risk are these companies taking on by
> using the DoD ranges on their internal networks? And have they
> quantified the costs of this outage against moving to IPv6?

Honestly I can't think of much unless maybe they're a defense contractor
that would potentially end up with DoD ranges (non-isolated/classified
networks) in their view of the global routing table. Appropriately
treating it like "my networks" and/or RFC1918 in your routing policies
(not exporting it, not accepting routes for it, etc.) would be required
to properly ensure network stability of course.

Some OSes treat RFC1918 space as inherently "special" (extra trusted,
etc.) and wouldn't treat the DoD ranges as such, but those behaviors are
typically undesirable or at least not relied on on a network of that
scale, anyway.

Not that I'd recommend it.
--
Brandon Martin

Yeah, definitely talking about use that is deep behind multiple layers of
firewalls, or maybe even air-gapped with respect to routable protocols. I
won't say what sort of industry runs large piles of ancient gear, but you
could probably guess...

On Wed, Jan 20, 2021 at 10:13 AM Brandon Martin <lists.nanog@monmotha.net>
wrote:

> On 1/20/21 9:58 AM, j k wrote:
> > My question becomes, what level of risk are these companies taking on by
> > using the DoD ranges on their internal networks? And have they
> > quantified the costs of this outage against moving to IPv6?
>
> Honestly I can't think of much unless maybe they're a defense contractor
> that would potentially end up with DoD ranges (non-isolated/classified
> networks) in their view of the global routing table. Appropriately
> treating it like "my networks" and/or RFC1918 in your routing policies
> (not exporting it, not accepting routes for it, etc.) would be required
> to properly ensure network stability of course.
>
> Some OSes treat RFC1918 space as inherently "special" (extra trusted,
> etc.) and wouldn't treat the DoD ranges as such, but those behaviors are
> typically undesirable or at least not relied on on a network of that
> scale, anyway.
>
> Not that I'd recommend it.
> --
> Brandon Martin
>

I recently had a discussion with an Asian ISP that was asking the IETF to PLEASE re-declare DoD space to be private space so that they could use it. This particular ISP uses IPv6 extensively (a lot of their services are in fact IPv6-only) but has trouble with its enterprise customers. Frankly, enterprise use of IPv6 is a problem; they seem to push back pretty hard against using IPv6.

I find this thread highly appropriate.

> On Jan 20, 2021, at 6:58 AM, j k <jsklein@gmail.com> wrote:
>
> My question becomes, what level of risk are these companies taking on by using the DoD ranges on their internal networks? And have they quantified the costs of this outage against moving to IPv6?
>
> Joe Klein
> "inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1)
> "I skate to where the puck is going to be, not to where it has been." -- Wayne Gretzky
> "I never lose. I either win or learn" - Nelson Mandela
>
>
>
> On Wed, Jan 20, 2021 at 9:06 AM John Curran <jcurran@istaff.org> wrote:
> Indeed.
> /John
>
> > On Jan 20, 2021, at 8:47 AM, Cynthia Revström <me@cynthia.re> wrote:
> >
> > But if you do this, make sure you keep track of where you might have put policies like this in, in case the DoD sells some the space or whatever in the future.
>

On 1/20/21 10:05 AM, Dorn Hetzel wrote:
> I am aware of some companies that have used parts of a DoD /8 internally to
> address devices in the field that are too old to ever support IPV6. Those
> devices also never interact with the public internet, and never will, so
> for them, I guess the only risk would be that some other internal system
> that wants to talk to those devices would not also be able to talk to any
> endpoint on the public internet that wound up using space allocated from
> that block, some time in the future. Is that about right or am I missing
> some key failure point?

You're free to use any IP space you want internally, no one is going to tell
you what to do inside your network. Most providers will not route it for you
though. There are some exceptions to this, the GRX being one, but that's it's
own VPN and separate network from the global Internet. IIRC, here was some
VPN provider using 5/8 before that was assigned.

AFAIK IANA and the RIR's cannot enforce use of IP space assignments on any
network.
--
Bryan Fields

727-409-1194 - Voice
http://bryanfields.net