>I remember reading about full IPv4-space scans showing some fairly massive blocks that were allocated but unused.
Just because an IP doesn't answer to someone - especially coming from the general internet - doesn't mean it's not in use. This should be obvious to anyone even with the tiniest amount of understanding of TCP/IP networking and IT in general. Hence the authors of such a 'scan' aren't that credible to me. Unless 'scan' is something totally different.
If a machine doesn't answer to the Internet, it has no need of a public IPv4 address. A machine that only answers to other machines in the same organization should be assigned an address in the 10.0.0.0/8 range. If the organization is not large, even 192.168.0.0/16 would do. In fact, many people would argue that assigning public IP addresses to intranet resources is very bad for security.
Of course, some of these machines actually might have valid justification for squatting on a public IPv4 address. Perhaps their firewalls are configured to drop all packets except those from a handful of "trusted" IP addresses, so a random scanner on the Internet gets no response.
But I doubt that such cases account for the majority of "seemingly unused" IPv4 blocks. What's more likely is that some large organization was assigned a massive block of IPs 20-30 years ago and never found much use for them. IBM owns 9/8. Xerox owns 13/8. HP owns 15/8. Apple owns 17/8. Ford owns 19/8. Several pharmaceutical and chemical companies also own an /8 each, as do some universities. Do they really need 16.7 million public IPv4 addresses? Of course not. But I wouldn't be surprised if they started to sell bits and pieces of their blocks once the price per IP goes up enough.
A machine that only answers to other machines in the same organization should be assigned an address in the 10.0.0.0/8 range. If the organization is not large, even 192.168.0.0/16 would do. In fact, many people would argue that assigning public IP addresses to intranet resources is very bad for security.
That's a horrible hack and those people are wrong. Separate your concerns; addresses for addressing, firewalls for firewalling. Using private addresses adds extra complications; what if someone's home network uses the same range and they want to connect to your VPN? What if you merge with another company that's using the same range? What if you want to use FTP or SIP or any other protocol that uses the internet the way it was intended to connect to a server in a different office, are your packets going to make it through or not? You'll observe that private addresses have been deliberately left out of IPv6, for good reason.
B) I agree there are inconveniences and complications with using private addresses in ipv4. But it seems to be necessary thrift in the ipv4 world of rapidly expiring address space; using public routable ipv4 addresses for machines which do not communicate with the public internet is perhaps a luxury we can not afford, even in cases where to do otherwise is inconvenient or complicated.
These /8's have been historically been used internally there's no reason they should be handed back. Handing them back would just prolong the migration to IPv6 for limited benefit.
I imagine the only reason you would use a IPv6 private address is if you didn't have allocated global ones. It's just replacing no chance of collision with some chance of collision.
You are defending the broken windows fallacy. Wikipedia can explain better than I do, but the TLDR is simply : you are defending useless destruction of value, the end result is that everyone's poorer, nothing else.
No, just the opposite. There would be real costs for those companies that have /8s to move away from them. Meanwhile the gains would be minimal - at best it might allow some organizations to put off moving to IPv6 for a few months.
Comments
>I remember reading about full IPv4-space scans showing some fairly massive blocks that were allocated but unused.
Just because an IP doesn't answer to someone - especially coming from the general internet - doesn't mean it's not in use. This should be obvious to anyone even with the tiniest amount of understanding of TCP/IP networking and IT in general. Hence the authors of such a 'scan' aren't that credible to me. Unless 'scan' is something totally different.
If a machine doesn't answer to the Internet, it has no need of a public IPv4 address. A machine that only answers to other machines in the same organization should be assigned an address in the 10.0.0.0/8 range. If the organization is not large, even 192.168.0.0/16 would do. In fact, many people would argue that assigning public IP addresses to intranet resources is very bad for security.
Of course, some of these machines actually might have valid justification for squatting on a public IPv4 address. Perhaps their firewalls are configured to drop all packets except those from a handful of "trusted" IP addresses, so a random scanner on the Internet gets no response.
But I doubt that such cases account for the majority of "seemingly unused" IPv4 blocks. What's more likely is that some large organization was assigned a massive block of IPs 20-30 years ago and never found much use for them. IBM owns 9/8. Xerox owns 13/8. HP owns 15/8. Apple owns 17/8. Ford owns 19/8. Several pharmaceutical and chemical companies also own an /8 each, as do some universities. Do they really need 16.7 million public IPv4 addresses? Of course not. But I wouldn't be surprised if they started to sell bits and pieces of their blocks once the price per IP goes up enough.
That's a horrible hack and those people are wrong. Separate your concerns; addresses for addressing, firewalls for firewalling. Using private addresses adds extra complications; what if someone's home network uses the same range and they want to connect to your VPN? What if you merge with another company that's using the same range? What if you want to use FTP or SIP or any other protocol that uses the internet the way it was intended to connect to a server in a different office, are your packets going to make it through or not? You'll observe that private addresses have been deliberately left out of IPv6, for good reason.
A) As I understand it, IPv6 still has private addresses, although they contain a random element to attempt to minimize collision when private networks are merged. http://en.wikipedia.org/wiki/Private_network#Private_IPv6_ad...
B) I agree there are inconveniences and complications with using private addresses in ipv4. But it seems to be necessary thrift in the ipv4 world of rapidly expiring address space; using public routable ipv4 addresses for machines which do not communicate with the public internet is perhaps a luxury we can not afford, even in cases where to do otherwise is inconvenient or complicated.
These /8's have been historically been used internally there's no reason they should be handed back. Handing them back would just prolong the migration to IPv6 for limited benefit.
I imagine the only reason you would use a IPv6 private address is if you didn't have allocated global ones. It's just replacing no chance of collision with some chance of collision.
You are defending the broken windows fallacy. Wikipedia can explain better than I do, but the TLDR is simply : you are defending useless destruction of value, the end result is that everyone's poorer, nothing else.
http://en.wikipedia.org/wiki/Parable_of_the_broken_window
No, just the opposite. There would be real costs for those companies that have /8s to move away from them. Meanwhile the gains would be minimal - at best it might allow some organizations to put off moving to IPv6 for a few months.
Yes, but they were a late addition, postdating IPv6 by 10 years, and aren't meant to be used lightly.
IPv6 is designed for easy & automatic renumbering so there's less need to hold on to a specific prefix as an "island of stability".
I work for a company that regularly acquires smaller companies who all thought using 10/8 was a good idea. Merging N of these networks is a disaster.
What's the best green-field recommendation for said companies?
Just get real IP addresses even if you have to buy them. The cost should be minimal compared to the total IT cost.
Interesting, last time I did this was 1996 (and last time I wore the net admin hat) we had our own range for internal use.
Just gotta make sure OSPF, (E/I)BGP and L2/L3 drop these ranges though.