Subject: [RAM] Robin Whittle's comments on /8 networks

From: RJ Atkinson <[email-masked]>
Date: Mon, 9 Apr 2007 17:18:32 -0400

I think Robin's claims about little-used or
unused /8 networks are largely incorrect.

	I am familiar with several of those networks, because
they belong to customers.  In each case that I'm familiar with,
there are substantial security measures (e.g. firewalls, IDS/IPSs,
packet filters) deployed at/near the edges of those networks.
Preventing external probe packets is a very very common security
policy for any organisation these days.

Yours,

Ran

_______________________________________________
RAM mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ram

---

From: Robin Whittle <[email-masked]>
Date: Tue, 10 Apr 2007 13:31:27 +1000

Hi Ran,

If this is off-topic for the RAM list, I would appreciate you and
anyone else writing to me directly to help me understand the usage
or one or more of the /8 networks which are advertised.

I know some of them are advertised as multiple BGP routes and do
have significant rates of ping-response.  In the absence of anything
to the contrary, I tentatively assume that if a whole /8 is
advertised as one BGP route, then the traffic on this /8 would be
pretty light compared to the traffic on a /8 which is advertised as
many BGP routes.  In this case I tentatively assume that a much
lower than average proportion of their IP addresses are used.

If I don't get a response from random pings to one in 917 IP
addresses, I tentatively assume that few, if any, IP addresses are
used, or alternatively that there is a complete block on pings or
acknowledgments.  Total blocking of pings might make sense if the
organisation itself was the only user of those 16 million IP
addresses.  But in that case, I assume they won't be using more than
a fraction of a percent or so, since I can't imagine any
organisation needing more than 50,000 or so IP addresses.	

I will update my page:

  http://www.firstpr.com.au/ip/host-density-per-prefix/

according to whatever information you or others can provide and will
write to this list with a summary of that information.

  - Robin

> I think Robin's claims about little-used or unused /8 networks
> are largely incorrect.
>
> I am familiar with several of those networks, because they
> belong to customers.  In each case that I'm familiar with, there
> are substantial security measures (e.g. firewalls, IDS/IPSs,

---

From: Roland Dobbins <[email-masked]>
Date: Mon, 9 Apr 2007 20:42:35 -0700

On Apr 9, 2007, at 8:31 PM, Robin Whittle wrote:

> But in that case, I assume they won't be using more than

There are more things in Heaven and Earth, Horatio,
Than are dreamt of in your philosophy.

;>

There are many such organizations.  Ran is correct, there's no way  
that can be inferred, and the above speculation is incorrect.

-----------------------------------------------------------------------
Roland Dobbins <[email-masked]> // 408.527.6376 voice

         Words that come from a machine have no soul.

                       -- Duong Van Ngo

---

From: Robin Whittle <[email-masked]>
Date: Tue, 10 Apr 2007 17:27:58 +1000

This message discusses LISP vs. SRAM-based forwarding too.

> Than are dreamt of in your philosophy.

This is not my philosophy.  It was a tentative assumption I am happy
to change with the help of people who know more about this than I
do, which includes most people on this list.

> that can be inferred, and the above speculation is incorrect.

I am keen to know details to the contrary.

One list member wrote to me privately that a large telco has over
330k individual IP addresses including those for nearly 27k router
interfaces, some of which are on /30s.  This company doesn't have a
complete /8.  Even if another organisation with a /8 had this number
of IP addresses in use, this would be comparatively low: 2% usage of
16 million.  The average ping response rate for all /12 BGP prefixes
was 14.7%.

I doubt that the organisations with /8s I am thinking of:

  3.0.0.0/8  0% May94 General Electric Company
 15.0.0.0/8  0% Jul94 Hewlett-Packard Company
 16.0.0.0/8  0% Nov94 Digital Equipment Corporation (RIP)
 44.0.0.0/8  0% Jul92 Amateur Radio Digital Communicat
 45.0.0.0/8  0% Jan95 Interop Show Network
 53.0.0.0/8  0% Oct93 Cap Debis CCS
 55.0.0.0/8  0% Apr95 Boeing Computer Services
214.0.0.0/8  0% Mar98 US-DOD

have anything like 330k IP addresses in use.  None of the above
returned any ping responses.

The other complete BGP advertised /8s had non-zero ping response rates:

  4.0.0.0/8  0.5787% Dec92 Bolt Beranek & Newman } Level 3 ISP?
  8.0.0.0/8  0.1273% Dec92 Bolt Beranek & Newman }
 12.0.0.0/8  3.0266% Jun95 AT&T Bell Laboratories
 17.0.0.0/8  0.0058% Jul92 Apple Computer Inc.
 18.0.0.0/8  0.1215% Jan94 MIT
 32.0.0.0/8  0.0405% Jun94 Norsk Informasjonsteknology
 33.0.0.0/8  0.0058% Jan91 DLA Systems Automation Center
 35.0.0.0/8  0.0694% Apr94 MERIT Computer Network
 38.0.0.0/8  0.3877% Sep94 Performance Systems International
 57.0.0.0/8  0.0174% May95 SITA (http://sita.aero)
126.0.0.0/8  0.3414% Jan05 APNIC

Apart from the last of these, all the above are old /8 assignments
which I suspect are generally being used very lightly (apart from
AT&T's /8), in terms of number of IP addresses actually in use,
compared to the rest of the advertised address space.  I am keen to
learn anything to confirm this or to the contrary.

There are 318 million IP addresses in these 19 /8s.  I am sure that
many other BGP prefixes have unacceptably low rates of actual
address utilisation, but on average, not as spectacularly low as
these /8s.

If all DFZ routers, say in 2013 or 2014, had SRAM-based IP
forwarding and so were capable of instantly classifying IPv4 packets
on /24 boundaries, the above address space could easily be broken up
and used very efficiently.  This would be administratively easy,
since it only negatively impacts a handful of organisations.

LISP 1.5+ involves taking away something from most or all ISPs and
AS end-user organisations - the BGP routability of the majority of
address space - unless LISP is only used for the majority of
prefixes assigned by RIRs after LISP becomes practical.

I am assuming that there is no direct benefit for the end-user in
tunneling through LISP compared to simply advertising the prefix
normally.  Is this the case?  Alternatively, for instance, could
LISP help with traffic engineering in some way which is not possible
with current BGP routing?  Or which could be done with BGP routing
but is undesirable on the global scale, due to the load on the whole
system of propagating whatever relatively frequent changes the TE
involved?

With SRAM-forwarding in the DFZ routers, no matter how this small
number of /8 organisations have scattered their current usage, they
could keep those address ranges, down to  /24 boundaries, so they
wouldn't need to renumber anything.

It is not OK for the world to be running out of IPv4 address space
while huge slabs of space remain dramatically under-utilised.  The
only ways of using the IPv4 address space more efficiently all
involve more and more smaller assignments to a growing number of
ISPs and AS end-users, most of whom need to multihome.  The
approaches seem to be:

1 - Build future generations of routers with more and more
    TCAM etc. to cope with continued growth in the number of
    advertised prefixes.

2 - Make a large fraction of current and future assigned address
    space not routable by the global BGP system and rely on LISP
    1.5+ or a similar system to tunnel it through the remaining,
    relatively small, number of BGP advertised prefixes.  The number
    of BGP advertised prefixes will need to grow anyway, as more and
    more border routers are added.

    Develop new protocols and centralised databases.  Create new
    router software and potentially hardware to handle the packet
    analysis, header insertion and removal, mapping cache, DNS
    handling (or DNS snooping?) - and then deploy a large number of
    these routers around the edge of the Internet.  Would this
    involve a larger number of routers than would be in the DFZ?

3 - <marketing>Leave the horse and buggy days of Internet routing
    behind</marketing>, install a new generation of SRAM-based
    routers in the DFZ, forget about route aggregation, and convert
    the global BGP network into something resembling a flat switched
    network where a growing number of border routers receive packets
    on 14.5 million /24 boundaries.  IPv4 address space to this
    granularity can be assigned without concern for network
    topology, but it is best not to change the assignments for
    reasons other than long-term network structure and short-term
    adaptation to failures.  At the same time, ideally, achieve
    similar flat routing for IPv6 - over a smaller range than the
    current /3.

  - Robin

  http://tools.ietf.org/html/draft-whittle-sram-ip-forwarding-01
  http://www.firstpr.com.au/ip/sram-ip-forwarding/

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 10 Apr 2007 14:25:05 +0200

> ...since I can't imagine any

Working for an organisation with ~380,000 employees, this
doesn't defeat my imagination.

     Brian

---

From: Roland Dobbins <[email-masked]>
Date: Tue, 10 Apr 2007 08:41:06 -0700

> returned any ping responses.

These doubts are unfounded for at least for of the ones you list.

Again, the fact that one doesn't receiv echo replies is meaningless.   
iACLs.

                       -- Duong Van Ngo