subject:"Re\: DoD IP Space"

On 25 Apr 2021, at 4:59 PM, Sabri Berisha 
mailto:sa...@cluecentral.net>> wrote:

- On Apr 25, 2021, at 2:24 AM, Bill Woodcock 
wo...@pch.net wrote:

Hi,

I think I’d characterize it, rather, as a possible privatization of public
property.

This comment sparked my curiosity. Does ARIN consider IP space to be property?

One could argue both ways:

1. Whomever "owns" a netblock simply owns the right to use and advertise it as 
long
as it's being used for the purposes under which it was assigned by a number 
registry.
This would be similar to "apartment rights" in a condominium complex.

OR;

2. IP space comes with property rights such as selling and leasing as one 
wishes. But,
that would also imply that IP space can be stolen.

I'd be curious to hear what ARIN's position is on this.

Sabri -

ARIN’s position can be clearly found in section 2 of the Registration Services 
Agreement  -

– When parties are issued IP address blocks, they are given a limited bundle of 
contractual rights to an entry in the registry database.
– These rights include the exclusive right to be associated with a specific 
entry, the exclusive right to administer that entry in the ARIN registry 
database, and exclusive right of transfer this bundle of rights in accordance 
with adopted policy.

Two things:  a) None of this pertains to a right to announce or route an IP 
address block – ISPs each control their own routing and often care about who 
holds rights to a block in the registry, but that does not equate to issuing a 
“right to route.”   b) You’ll probably want to discuss with legal counsel for 
more specifics of the nuances between contractual rights versus property 
rights, particularly when if comes to intangible rights, enforceability against 
specific parties versus the world, etc.

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DoD IP Space

2021-04-25 Thread j k

In the positive side of things, guess we will see IPv6 usage.

Joe Klein

On Sun, Apr 25, 2021, 6:11 PM John Curran  wrote:

> Sronan -
>
> I made no claims other than pointing out that IP address blocks in the
> ARIN registry are subject to ARIN policies.
>
> ARIN was formed specifically so that the Internet community could engage
> in self-regulation for IP number resources; to wit: "Creation of ARIN will
> give the users of IP numbers (mostly Internet service providers,
> corporations and other large institutions) a voice in the policies by which
> they are managed and allocated within the North American region” [1] – thus
> ARIN's policies for management of the registry apply to all resources in
> the registry because that was inherent to the purpose to which ARIN was
> formed.
>
> This includes having ARIN "assume full responsibility for Internet
> Protocol (IP) number assignments and related administrative tasks
> previously handled by NSI.”, whereby ARIN formally became the successor
> registry operator for organizational assignments in a long chain that
> includes USC/ISI, SRI, GSI, and NSI.
>
> The community wanted self-governance, and that’s exactly what it got…  the
> result is a fairly important reason to participate in ARIN policy
> development and/or governance if you feel strongly about these matters.
>
> Thanks!
> /John
>
> John Curran
> President and CEO
> American Registry for Internet Numbers
>
> [1] https://www.nsf.gov/news/news_summ.jsp?cntn_id=102819 - "Internet
> Moves Toward Privatization / IP numbers handled by non-profit”
>
>
> On Apr 25, 2021, at 11:38 AM, sro...@ronan-online.com wrote:
>
>  So you are claiming that ARIN has jurisdiction over DoD IP space?
>
> Sent from my iPhone
>
> On Apr 25, 2021, at 9:13 AM, John Curran  wrote:
>
>  Sronan -
>
> I’d suggest asking rather than making assertions when it comes to ARIN, as
> this will avoid propagating existing misinformation in the community.
>
> Many US government agencies, including the US Department of Defense, have
> signed registration services agreements with ARIN.
>
> From https://account.arin.net/public/member-list -
>
> United States Department of Defense (DoD)
>
> USDDD 
>
>
> Thanks!
> /John
>
> John Curran
> President and CEO
> American Registry for Internet Numbers
>
> On 25 Apr 2021, at 8:54 AM, sro...@ronan-online.com wrote:
>
> Except these DoD blocks don’t fall under ARIM justification, as they
> predate ARIN. It is very likely that the DoD has never and will never sign
> any sort of ARIN agreement.
>
> Sent from my iPhone
>
> On Apr 25, 2021, at 3:40 AM, Mel Beckman  wrote:
>
> Mark,
>
> ARIN rules require every IP space holder to publish accurate — and
> effective —  Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I
> pointed out, and as you can test for yourself. Your expectation that the
> DOD will “generally comply with all of the expected norms” is sorely naive,
> and already disproven.
>
> As far as “why does anyone on the Internet need to publish to your
> arbitrary standards”, you seem to forget that in the U.S., the government
> is accountable to the People. Where a private company may not have to
> explain its purposes, the government most certainly does in the private
> sector. With these IP spaces being thrust into the civilian realm, yes,
> they owe the citizenry an explanation of their actions, just as they would
> if they had started mounting missile launchers on highway overpasses. It’s
> a direct militarization of a civilian utility.
>
> Keep in mind that the U.S. Government — under all administrations — has
> shown that it will abuse every technical advantage it can, as long as it
> can do so in secret. Perhaps you’ve forgotten James Clapper, the former
> director of national intelligence, who falsely testified to Congress that
> the government does “not wittingly” collect the telephone records of
> millions of Americans. And he was just the tip of the iceberg. Before
> Clapper under Obama there was the Bush administration’s Stellar Wind"
> warrantless surveillance program. The list of government abuse of civilian
> resources is colossal .
>
> Fighting against that isn’t political. It’s patriotic.
>
> -mel
>
> On Apr 25, 2021, at 12:02 AM, Mark Foster  wrote:
>
> 
>
> On 25/04/2021 3:24 am, Mel Beckman wrote:
>
> This doesn’t sound good, no matter how you slice it. The lack of
> transparency with a civilian resource is troubling at a minimum. I’m going
> to bogon this space as a defensive measure, until its real — and detailed —
> purpose can be known. The secret places of our government have proven
> themselves untrustworthy in the protection of citizens’ data and networks.
> They tend to think they know “what’s good for” us.
>
> -mel
>
>
> Why does anyone on the Internet need to publish to your arbitrary
> standards, what they intend to do with their IP address ranges?
>
> Failure to advertise the IP address space to the

Re: DoD IP Space

Sronan -

I made no claims other than pointing out that IP address blocks in the ARIN 
registry are subject to ARIN policies.

ARIN was formed specifically so that the Internet community could engage in 
self-regulation for IP number resources; to wit: "Creation of ARIN will give 
the users of IP numbers (mostly Internet service providers, corporations and 
other large institutions) a voice in the policies by which they are managed and 
allocated within the North American region” [1] – thus ARIN's policies for 
management of the registry apply to all resources in the registry because that 
was inherent to the purpose to which ARIN was formed.

This includes having ARIN "assume full responsibility for Internet Protocol 
(IP) number assignments and related administrative tasks previously handled by 
NSI.”, whereby ARIN formally became the successor registry operator for 
organizational assignments in a long chain that includes USC/ISI, SRI, GSI, and 
NSI.

The community wanted self-governance, and that’s exactly what it got…  the 
result is a fairly important reason to participate in ARIN policy development 
and/or governance if you feel strongly about these matters.

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

[1] https://www.nsf.gov/news/news_summ.jsp?cntn_id=102819 - "Internet Moves 
Toward Privatization / IP numbers handled by non-profit”


On Apr 25, 2021, at 11:38 AM, 
sro...@ronan-online.com wrote:

 So you are claiming that ARIN has jurisdiction over DoD IP space?

Sent from my iPhone

On Apr 25, 2021, at 9:13 AM, John Curran 
mailto:jcur...@arin.net>> wrote:

 Sronan -

I’d suggest asking rather than making assertions when it comes to ARIN, as this 
will avoid propagating existing misinformation in the community.

Many US government agencies, including the US Department of Defense, have 
signed registration services agreements with ARIN.

From https://account.arin.net/public/member-list -

United States Department of Defense (DoD)

USDDD

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

On 25 Apr 2021, at 8:54 AM, 
sro...@ronan-online.com wrote:

Except these DoD blocks don’t fall under ARIM justification, as they predate 
ARIN. It is very likely that the DoD has never and will never sign any sort of 
ARIN agreement.

Sent from my iPhone

On Apr 25, 2021, at 3:40 AM, Mel Beckman 
mailto:m...@beckman.org>> wrote:

Mark,

ARIN rules require every IP space holder to publish accurate — and effective —  
Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I pointed out, and as 
you can test for yourself. Your expectation that the DOD will “generally comply 
with all of the expected norms” is sorely naive, and already disproven.

As far as “why does anyone on the Internet need to publish to your arbitrary 
standards”, you seem to forget that in the U.S., the government is accountable 
to the People. Where a private company may not have to explain its purposes, 
the government most certainly does in the private sector. With these IP spaces 
being thrust into the civilian realm, yes, they owe the citizenry an 
explanation of their actions, just as they would if they had started mounting 
missile launchers on highway overpasses. It’s a direct militarization of a 
civilian utility.

Keep in mind that the U.S. Government — under all administrations — has shown 
that it will abuse every technical advantage it can, as long as it can do so in 
secret. Perhaps you’ve forgotten James Clapper, the former director of national 
intelligence, who falsely testified to Congress that the government does “not 
wittingly” collect the telephone records of millions of Americans. And he was 
just the tip of the iceberg. Before Clapper under Obama there was the Bush 
administration’s Stellar Wind" warrantless surveillance program. The list of 
government abuse of civilian resources is colossal .

Fighting against that isn’t political. It’s patriotic.

-mel

On Apr 25, 2021, at 12:02 AM, Mark Foster 
mailto:blak...@blakjak.net>> wrote:


On 25/04/2021 3:24 am, Mel Beckman wrote:
This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us.

-mel


Why does anyone on the Internet need to publish to your arbitrary standards, 
what they intend to do with their IP address ranges?

Failure to advertise the IP address space to the Internet (until now, perhaps) 
doesn't make the address space any less legitimate, and though I'd expect the 
DoD to generally comply with all of the expected

Re: DoD IP Space

2021-04-25 Thread Sabri Berisha

- On Apr 25, 2021, at 2:24 AM, Bill Woodcock wo...@pch.net wrote:

Hi,

> I think I’d characterize it, rather, as a possible privatization of public
> property.

This comment sparked my curiosity. Does ARIN consider IP space to be property?

One could argue both ways:

1. Whomever "owns" a netblock simply owns the right to use and advertise it as 
long
as it's being used for the purposes under which it was assigned by a number 
registry.
This would be similar to "apartment rights" in a condominium complex.

OR;

2. IP space comes with property rights such as selling and leasing as one 
wishes. But,
that would also imply that IP space can be stolen.

I'd be curious to hear what ARIN's position is on this. 

Thanks,

Sabri

Re: DoD IP Space

Randy -

We don’t generally speak about specific customers – but I do acknowledge this 
is a bit of an unusual case...

There was no exchange at all, but rather the US DoD wanted to make sure that 
(if at some
point in the future) they had excess IPv4 resources that the DoD retained the 
ability to reutilize such elsewhere within the US Government rather than 
returning them to ARIN.

(You have to remember this was a point in time when many organizations were 
retuned unused IPv4 blocks in order to help with IPv4 longevity...) 

ARIN provided them clarity in that regard (as requiring return when other 
departments had need for IPv4 number resources was never the intent), and that 
has since been completely preempted by the adoption of transfer policies by the 
ARIN community.

Thanks,
/John

John Curran
President and CEO
American Registry for Internet Numbers

> On Apr 25, 2021, at 12:32 PM, Randy Bush  wrote:
> 
> john,
> 
> my altzheimer's device tells me that some years back there was a
> documented written agreement between arin and the dod along the lines of
> dod getting a large swath of ipv6 space[0] in exchange for agreeing to
> return[1] or otherwise put into public use a half dozen ipv4 /8s.
> 
> could you refresh my memory, e.g. with the document, please?  thanks.
> 
> randy
> 
> --
> 
> [0] which they are still trying to figure out how to use; bit isn't half
>the internet in a similar pinch. :)
> 
> [1] since the dod probably did not get the space from arin, 'return' is
>probably not a good term.
> 
> 
> ---
> ra...@psg.com
> `gpg --locate-external-keys --auto-key-locate wkd ra...@psg.com`
> signatures are back, thanks to dmarc header butchery
>

Re: DoD IP Space

2021-04-25 Thread Michael Butler via NANOG


On 4/25/21 12:32 PM, Randy Bush wrote:

john,

my altzheimer's device tells me that some years back there was a
documented written agreement between arin and the dod along the lines of
dod getting a large swath of ipv6 space[0] in exchange for agreeing to
return[1] or otherwise put into public use a half dozen ipv4 /8s.

could you refresh my memory, e.g. with the document, please?  thanks.

randy

--

[0] which they are still trying to figure out how to use; bit isn't half
 the internet in a similar pinch. :)

[1] since the dod probably did not get the space from arin, 'return' is
 probably not a good term.


The footnote (11) on page 7 of https://www.gao.gov/assets/gao-20-402.pdf 
seems to be most relevant ..


"We are not aware of any statutory requirements that directly address 
the ability of a government agency to transfer or sell IP addresses to a 
third party, but DOD would face legal and policy constraints to any 
potential sale or transfer of the addresses to a third party outside of 
the government. Among other things, this is because DOD entered into an 
agreement with the American Registry for Internet Numbers. Specifically, 
this agreement states the department must return unused addresses to the 
registry."


imb

Re: DoD IP Space

2021-04-25 Thread Randy Bush

john,

my altzheimer's device tells me that some years back there was a
documented written agreement between arin and the dod along the lines of
dod getting a large swath of ipv6 space[0] in exchange for agreeing to
return[1] or otherwise put into public use a half dozen ipv4 /8s.

could you refresh my memory, e.g. with the document, please?  thanks.

randy

--

[0] which they are still trying to figure out how to use; bit isn't half
the internet in a similar pinch. :)

[1] since the dod probably did not get the space from arin, 'return' is
probably not a good term.


---
ra...@psg.com
`gpg --locate-external-keys --auto-key-locate wkd ra...@psg.com`
signatures are back, thanks to dmarc header butchery

Re: DoD IP Space

2021-04-25 Thread Martin Hannigan

On Sat, Apr 24, 2021 at 11:27 AM Mel Beckman  wrote:

> This doesn’t sound good, no matter how you slice it. The lack of
> transparency with a civilian resource is troubling at a minimum. I’m going
> to bogon this space as a defensive measure, until its real — and detailed —
> purpose can be known. The secret places of our government have proven
> themselves untrustworthy in the protection of citizens’ data and networks.
> They tend to think they know “what’s good for” us.
>
>  -mel
>
>

If you apply that ideology to 0/0 you're not going to have much of an
Internet beyond cat pics.

Wish i was in the room when they turned it on. I hope they make a tiktok of
the expressions of everyone looking at the first data. [ joke ]

Warm regards,

-M<


> On Apr 24, 2021, at 8:05 AM, John Curran  wrote:
>
> 
> As noted -
> https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G
>
> FYI,
> /John
>
> John Curran
> President and CEO
> American Registry for Internet Numbers
>
> On Jan 20, 2021, at 8:35 AM, John Curran  wrote:
>
> 
> Tom –
>
> Most definitely: lack of routing history is not at all a reliable
> indicator of the potential for valid routing of a given IPv4 block in the
> future, so best practice suggest that allocated address space should not be
> blocked by others without specific cause.
>
> Doing otherwise opens one up to unexpected surprises when issued space
> suddenly becomes more active in routing and is yet is inexplicably
> unreachable for some destinations.
>
> /John
>
> On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote:
>
>
> Using the generally accepted definition of a bogon ( RFC 1918 / 5735 /
> 6598 + netblock not allocated by an RiR ), 22/8 is not a bogon and
> shouldn't be treated as one.
>
> The DoD does not announce it to the DFZ, as is their choice, but nothing
> says they may not change that position tomorrow. There are plenty of
> subnets out there that are properly allocated by an RiR, but the assignees
> do not send them to the DFZ because of $reasons.
>
> In my opinion, creating bogon lists that include allocated but not
> advertised prefixes is poor practice that is likely to end up biting an
> operator at one point or another.
>
> On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov 
> wrote:
>
>> Peace,
>>
>> On Tue, Nov 5, 2019, 4:55 PM David Conrad  wrote:
>> > On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG 
>> wrote:
>> >> This thread got me to wondering, is there any
>> >> legitimate reason to see 22/8 on the public
>> >> Internet?  Or would it be okay to treat 22/8
>> >> like a Bogon and drop it at the network edge?
>> >
>> > Given the transfer market for IPv4 addresses,
>> > the spot price for IPv4 addresses, and the need
>> > of even governments to find “free” (as in
>> > unconstrained) money, I’d think treating any
>> > legacy /8 as a bogon would not be prudent.
>>
>> It has been said before in this thread that the DoD actively uses this
>> network internally.  I believe if the DoD were to cut costs, they
>> would be able to do it much more effectively in many other areas, and
>> their IPv4 networks would be about the last thing they would think of
>> (along with switching off ACs Bernard Ebbers-style).  With that in
>> mind, treating the DoD networks as bogons now makes total sense to me.
>>
>> --
>> Töma
>>
>

Re: DoD IP Space

2021-04-25 Thread sronan

So you are claiming that ARIN has jurisdiction over DoD IP space?

Sent from my iPhone

> On Apr 25, 2021, at 9:13 AM, John Curran  wrote:
> 
>  Sronan - 
> 
> I’d suggest asking rather than making assertions when it comes to ARIN, as 
> this will avoid propagating existing misinformation in the community. 
> 
> Many US government agencies, including the US Department of Defense, have 
> signed registration services agreements with ARIN.
> 
> From https://account.arin.net/public/member-list - 
> 
> United States Department of Defense (DoD)   USDDD
> 
> Thanks! 
> /John
> 
> John Curran
> President and CEO
> American Registry for Internet Numbers
> 
>>> On 25 Apr 2021, at 8:54 AM, sro...@ronan-online.com wrote:
>>> 
>>> Except these DoD blocks don’t fall under ARIM justification, as they 
>>> predate ARIN. It is very likely that the DoD has never and will never sign 
>>> any sort of ARIN agreement.
>>> 
>>> Sent from my iPhone
>>> 
>>> On Apr 25, 2021, at 3:40 AM, Mel Beckman  wrote:
>>> 
>>> Mark,
>>> 
>>> ARIN rules require every IP space holder to publish accurate — and 
>>> effective —  Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I 
>>> pointed out, and as you can test for yourself. Your expectation that the 
>>> DOD will “generally comply with all of the expected norms” is sorely naive, 
>>> and already disproven.
>>> 
>>> As far as “why does anyone on the Internet need to publish to your 
>>> arbitrary standards”, you seem to forget that in the U.S., the government 
>>> is accountable to the People. Where a private company may not have to 
>>> explain its purposes, the government most certainly does in the private 
>>> sector. With these IP spaces being thrust into the civilian realm, yes, 
>>> they owe the citizenry an explanation of their actions, just as they would 
>>> if they had started mounting missile launchers on highway overpasses. It’s 
>>> a direct militarization of a civilian utility. 
>>> 
>>> Keep in mind that the U.S. Government — under all administrations — has 
>>> shown that it will abuse every technical advantage it can, as long as it 
>>> can do so in secret. Perhaps you’ve forgotten James Clapper, the former 
>>> director of national intelligence, who falsely testified to Congress that 
>>> the government does “not wittingly” collect the telephone records of 
>>> millions of Americans. And he was just the tip of the iceberg. Before 
>>> Clapper under Obama there was the Bush administration’s Stellar Wind" 
>>> warrantless surveillance program. The list of government abuse of civilian 
>>> resources is colossal . 
>>> 
>>> Fighting against that isn’t political. It’s patriotic.
>>> 
>>> -mel 
>>> 
 On Apr 25, 2021, at 12:02 AM, Mark Foster  wrote:
 
 
>> On 25/04/2021 3:24 am, Mel Beckman wrote:
> This doesn’t sound good, no matter how you slice it. The lack of 
> transparency with a civilian resource is troubling at a minimum. I’m 
> going to bogon this space as a defensive measure, until its real — and 
> detailed — purpose can be known. The secret places of our government have 
> proven themselves untrustworthy in the protection of citizens’ data and 
> networks. They tend to think they know “what’s good for” us.
> 
> -mel
> 
 
 Why does anyone on the Internet need to publish to your arbitrary 
 standards, what they intend to do with their IP address ranges?
 
 Failure to advertise the IP address space to the Internet (until now, 
 perhaps) doesn't make the address space any less legitimate, and though 
 I'd expect the DoD to generally comply with all of the expected norms 
 around BGP arrangements and published whois details, at the end of the 
 day, they can nominate who should originate it from their AS and as long 
 as we can see who owns it it's just not our business.
 
 Any organisation who's used DoD space in a way that's likely to conflict 
 with, well, the DoD, gambled and lost.
 
 Mark.
 
>

Re: DoD IP Space

Sronan -

For avoidance of doubt (and to save folks some digging), I will observe that 
the number resources associated with the U.S. DoD handle I referenced do not 
include DoD’s legacy IPv4 number resource holdings.However, there are 
indeed are registration agreements with the US DoD that pertain to the DoD’s 
legacy IPv4 number resource holdings, and this may be readily confirmed by 
reviewing the CBO assessment report for the “NATIONAL DEFENSE AUTHORIZATION ACT 
FOR FISCAL YEAR 2020” (which in its early form envisioned potential 
monetization of select DoD IPv4 number resources) -

From the CBO assessment  


To estimate the potential receipts from the sale of IP
addresses, CBO examined the security risks and market factors
that would affect the number of addresses and the price for
those addresses that could be sold within the ten-year budget
window. CBO expects that DoD would not be prepared to sell any
addresses before 2022 for several reasons. First, over the next
two years DoD plans to study the cybersecurity requirements and
procedures that will support the department's transition of
IPv4 addresses to the next generation of IPv6 addresses.
Second, the agency would then have to update its internal
network operations in order to mitigate the security risks of
transferring DoD IP addresses to nonfederal entities.\5\ Third,
DoD would have to amend its existing agreement with the
American Registry for Internet Numbers (ARIN), which requires
DoD to release unneeded IP addresses to ARIN for
redistribution.

ARIN has no particular view on the merits/issues of US DoD disposition of its 
rights to IPv4 blocks (and this provision was omitted from the NDAA in its 
final form), but we did indicate to the DoD that ARIN polices for IPv4 address 
blocks have indeed changed, and that their agreement with ARIN does not 
preclude disposition of rights to IPv4 address blocks now that the ARIN 
community has established transfer policies allowing same.

(ARIN applies the community-developed policies to all number resources in the 
ARIN registry, and this includes blocks issued by predecessor operators of the 
registry.)

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers


On 25 Apr 2021, at 9:13 AM, John Curran 
mailto:jcur...@arin.net>> wrote:

Sronan -

I’d suggest asking rather than making assertions when it comes to ARIN, as this 
will avoid propagating existing misinformation in the community.

Many US government agencies, including the US Department of Defense, have 
signed registration services agreements with ARIN.

From https://account.arin.net/public/member-list -

United States Department of Defense (DoD)

USDDD

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

On 25 Apr 2021, at 8:54 AM, 
sro...@ronan-online.com wrote:

Except these DoD blocks don’t fall under ARIM justification, as they predate 
ARIN. It is very likely that the DoD has never and will never sign any sort of 
ARIN agreement.

Sent from my iPhone

On Apr 25, 2021, at 3:40 AM, Mel Beckman 
mailto:m...@beckman.org>> wrote:

Mark,

ARIN rules require every IP space holder to publish accurate — and effective —  
Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I pointed out, and as 
you can test for yourself. Your expectation that the DOD will “generally comply 
with all of the expected norms” is sorely naive, and already disproven.

As far as “why does anyone on the Internet need to publish to your arbitrary 
standards”, you seem to forget that in the U.S., the government is accountable 
to the People. Where a private company may not have to explain its purposes, 
the government most certainly does in the private sector. With these IP spaces 
being thrust into the civilian realm, yes, they owe the citizenry an 
explanation of their actions, just as they would if they had started mounting 
missile launchers on highway overpasses. It’s a direct militarization of a 
civilian utility.

Keep in mind that the U.S. Government — under all administrations — has shown 
that it will abuse every technical advantage it can, as long as it can do so in 
secret. Perhaps you’ve forgotten James Clapper, the former director of national 
intelligence, who falsely testified to Congress that the government does “not 
wittingly” collect the telephone records of millions of Americans. And he was 
just the tip of the iceberg. Before Clapper under Obama there was the Bush 
administration’s Stellar Wind" warrantless surveillance program. The list of 
government abuse of civilian resources is colossal .

Fighting against that isn’t political. It’s patriotic.

-mel

On Apr 25, 2021, at 12:02 AM, Mark Foster 
mailto:blak...@blakjak.net>> wrote:


On 25/04/2021 3:24 am, Mel Beckman wrote:
This doesn’t sound good, no matter how you

Re: DoD IP Space

Sronan -

I’d suggest asking rather than making assertions when it comes to ARIN, as this 
will avoid propagating existing misinformation in the community.

Many US government agencies, including the US Department of Defense, have 
signed registration services agreements with ARIN.

From https://account.arin.net/public/member-list -

United States Department of Defense (DoD)

USDDD

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers

On 25 Apr 2021, at 8:54 AM, 
sro...@ronan-online.com wrote:

Except these DoD blocks don’t fall under ARIM justification, as they predate 
ARIN. It is very likely that the DoD has never and will never sign any sort of 
ARIN agreement.

Sent from my iPhone

On Apr 25, 2021, at 3:40 AM, Mel Beckman 
mailto:m...@beckman.org>> wrote:

Mark,

ARIN rules require every IP space holder to publish accurate — and effective —  
Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I pointed out, and as 
you can test for yourself. Your expectation that the DOD will “generally comply 
with all of the expected norms” is sorely naive, and already disproven.

As far as “why does anyone on the Internet need to publish to your arbitrary 
standards”, you seem to forget that in the U.S., the government is accountable 
to the People. Where a private company may not have to explain its purposes, 
the government most certainly does in the private sector. With these IP spaces 
being thrust into the civilian realm, yes, they owe the citizenry an 
explanation of their actions, just as they would if they had started mounting 
missile launchers on highway overpasses. It’s a direct militarization of a 
civilian utility.

Keep in mind that the U.S. Government — under all administrations — has shown 
that it will abuse every technical advantage it can, as long as it can do so in 
secret. Perhaps you’ve forgotten James Clapper, the former director of national 
intelligence, who falsely testified to Congress that the government does “not 
wittingly” collect the telephone records of millions of Americans. And he was 
just the tip of the iceberg. Before Clapper under Obama there was the Bush 
administration’s Stellar Wind" warrantless surveillance program. The list of 
government abuse of civilian resources is colossal .

Fighting against that isn’t political. It’s patriotic.

-mel

On Apr 25, 2021, at 12:02 AM, Mark Foster 
mailto:blak...@blakjak.net>> wrote:


On 25/04/2021 3:24 am, Mel Beckman wrote:
This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us.

-mel


Why does anyone on the Internet need to publish to your arbitrary standards, 
what they intend to do with their IP address ranges?

Failure to advertise the IP address space to the Internet (until now, perhaps) 
doesn't make the address space any less legitimate, and though I'd expect the 
DoD to generally comply with all of the expected norms around BGP arrangements 
and published whois details, at the end of the day, they can nominate who 
should originate it from their AS and as long as we can see who owns it 
it's just not our business.

Any organisation who's used DoD space in a way that's likely to conflict with, 
well, the DoD, gambled and lost.

Mark.

Re: DoD IP Space

On 24 Apr 2021, at 6:45 PM, William Herrin
mailto:b...@herrin.us>> wrote:

On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman
mailto:m...@beckman.org>> wrote:
This doesn’t sound good, no matter how you slice it. The lack of
transparency with a civilian resource is troubling at a minimum.

You do understand that the addresses in question are not and have
never been "civilian." They came into DoD's possession when this was
all still a military project funded by what's now DARPA.

Personally, I think we may have an all time record for the largest
honeypot ever constructed. I'd love to be a fly on that wall.

Bill -

That’s actually a possibility - just join DDS…
https://apnews.com/article/technology-business-government-and-politics-b26ab809d1e9fdb53314f56299399949

‘ "The big Pentagon internet mystery now partially solved”
….
After weeks of wonder by the networking community, the Pentagon has now
provided a very terse explanation for what it’s doing. But it has not answered
many basic questions, beginning with why it chose to entrust management of the
address space to a company that seems not to have existed until September.

The military hopes to “assess, evaluate and prevent unauthorized use of DoD IP
address space,” said a statement issued Friday by Brett Goldstein, chief of the
Pentagon’s Defense Digital
Service,
which is running the project. It also hopes to “identify potential
vulnerabilities” as part of efforts to defend against cyber-intrusions by
global adversaries, who are consistently infiltrating U.S. networks, sometimes
operating from unused internet address blocks. '

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers

Re: DoD IP Space

2021-04-25 Thread sronan

Except these DoD blocks don’t fall under ARIM justification, as they predate 
ARIN. It is very likely that the DoD has never and will never sign any sort of 
ARIN agreement.

Sent from my iPhone

> On Apr 25, 2021, at 3:40 AM, Mel Beckman  wrote:
> 
> Mark,
> 
> ARIN rules require every IP space holder to publish accurate — and effective 
> —  Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I pointed out, 
> and as you can test for yourself. Your expectation that the DOD will 
> “generally comply with all of the expected norms” is sorely naive, and 
> already disproven.
> 
> As far as “why does anyone on the Internet need to publish to your arbitrary 
> standards”, you seem to forget that in the U.S., the government is 
> accountable to the People. Where a private company may not have to explain 
> its purposes, the government most certainly does in the private sector. With 
> these IP spaces being thrust into the civilian realm, yes, they owe the 
> citizenry an explanation of their actions, just as they would if they had 
> started mounting missile launchers on highway overpasses. It’s a direct 
> militarization of a civilian utility. 
> 
> Keep in mind that the U.S. Government — under all administrations — has shown 
> that it will abuse every technical advantage it can, as long as it can do so 
> in secret. Perhaps you’ve forgotten James Clapper, the former director of 
> national intelligence, who falsely testified to Congress that the government 
> does “not wittingly” collect the telephone records of millions of Americans. 
> And he was just the tip of the iceberg. Before Clapper under Obama there was 
> the Bush administration’s Stellar Wind" warrantless surveillance program. The 
> list of government abuse of civilian resources is colossal . 
> 
> Fighting against that isn’t political. It’s patriotic.
> 
> -mel 
> 
>> On Apr 25, 2021, at 12:02 AM, Mark Foster  wrote:
>> 
>> 
 On 25/04/2021 3:24 am, Mel Beckman wrote:
>>> This doesn’t sound good, no matter how you slice it. The lack of 
>>> transparency with a civilian resource is troubling at a minimum. I’m going 
>>> to bogon this space as a defensive measure, until its real — and detailed — 
>>> purpose can be known. The secret places of our government have proven 
>>> themselves untrustworthy in the protection of citizens’ data and networks. 
>>> They tend to think they know “what’s good for” us.
>>> 
>>> -mel
>>> 
>> 
>> Why does anyone on the Internet need to publish to your arbitrary standards, 
>> what they intend to do with their IP address ranges?
>> 
>> Failure to advertise the IP address space to the Internet (until now, 
>> perhaps) doesn't make the address space any less legitimate, and though I'd 
>> expect the DoD to generally comply with all of the expected norms around BGP 
>> arrangements and published whois details, at the end of the day, they can 
>> nominate who should originate it from their AS and as long as we can see who 
>> owns it it's just not our business.
>> 
>> Any organisation who's used DoD space in a way that's likely to conflict 
>> with, well, the DoD, gambled and lost.
>> 
>> Mark.
>>

RE: DoD IP Space

2021-04-25 Thread Jean St-Laurent via NANOG

This is true and very interesting, but the opposite is also true. 

They are now reachable from probably nearly anywhere and therefore open for 
business.  

Let's see what will slowly appear in shodan.io and shadowserver.org

Jean

-Original Message-
From: NANOG  On Behalf Of William 
Herrin
Sent: April 24, 2021 6:46 PM
To: Mel Beckman 
Cc: nanog@nanog.org
Subject: Re: DoD IP Space

On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman  wrote:
> This doesn’t sound good, no matter how you slice it. The lack of 
> transparency with a civilian resource is troubling at a minimum.

You do understand that the addresses in question are not and have never been 
"civilian." They came into DoD's possession when this was all still a military 
project funded by what's now DARPA.

Personally, I think we may have an all time record for the largest honeypot 
ever constructed. I'd love to be a fly on that wall.

Regards,
Bill Herrin

--
William Herrin
b...@herrin.us
https://bill.herrin.us/

Re: DoD IP Space

Mr. Beckman  - 

As noted by Mark Foster below, the listed contact information for the DoD 
address blocks is indeed correct, and (as you yourself confirmed) may be used 
to successfully contact the organization.  ARIN does not have the mandate to 
force any organization “to deal” with any other, but I can assure you that the 
contacts listed for the resources in the ARIN registry have been used to 
resolve actual technical problems without any difficultly. 

Best wishes,
/John

John Curran
President and CEO
American Registry for Internet Numbers


> On 25 Apr 2021, at 6:11 AM, Mark Foster  wrote:
> 
> Hi Mel,
> 
> I'd expect ARIN to hold them to account for complying with ARIN rules, if 
> they are subject.  In years gone by, I have been able to contact US DoD 
> organisations using published contact methods to address technical issues. So 
> even if there's technical non-compliance (which i'd agree should be 
> addressed), it could be a lot worse.
> 
> As for the DoD's accountability via your system of government, my view would 
> be that instead of bogon-filtering addresses legitimately appearing in your 
> BGP, with the justification being "they havn't before!", you could consider 
> asking them via channels. Like 
> https://open.defense.gov/transparency/foia.aspx for example.  But i'm not a 
> citizen of the United States, so will happily plead ignorance as to whether 
> this is likely to lead you to what you want to know or not.
> 
> In my country the government is also accountable to the people. But that 
> doesn't mean I would expect an Internet Service Provider to deliberately 
> sabotage the network access of their customers, either. Starts to feel like a 
> net neutrality argument again.
> 
> Mark.
> 
> PS: If DoD make use of IP address space that they legitimately hold, i'm not 
> sure you can call it a civilian resource, despite it interacting with 
> civilian counterparts.  Any consumable held by a military organisation is a 
> military resource and they'll make use of it based on their operational 
> requirements. The best comparison I could think of, would be fuel 
> (gasoline/petroleum/diesel/Jet-A1), all of which has both military and 
> civilian application.
> 
> On 25/04/2021 7:40 pm, Mel Beckman wrote:
>> Mark,
>> 
>> ARIN rules require every IP space holder to publish accurate — and effective 
>> —  Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I pointed out, 
>> and as you can test for yourself. Your expectation that the DOD will 
>> “generally comply with all of the expected norms” is sorely naive, and 
>> already disproven.
>> 
>> As far as “why does anyone on the Internet need to publish to your arbitrary 
>> standards”, you seem to forget that in the U.S., the government is 
>> accountable to the People. Where a private company may not have to explain 
>> its purposes, the government most certainly does in the private sector. With 
>> these IP spaces being thrust into the civilian realm, yes, they owe the 
>> citizenry an explanation of their actions, just as they would if they had 
>> started mounting missile launchers on highway overpasses. It’s a direct 
>> militarization of a civilian utility.
>> 
>> Keep in mind that the U.S. Government — under all administrations — has 
>> shown that it will abuse every technical advantage it can, as long as it can 
>> do so in secret. Perhaps you’ve forgotten James Clapper, the former director 
>> of national intelligence, who falsely testified to Congress that the 
>> government does “not wittingly” collect the telephone records of millions of 
>> Americans. And he was just the tip of the iceberg. Before Clapper under 
>> Obama there was the Bush administration’s Stellar Wind" warrantless 
>> surveillance program. The list of government abuse of civilian resources is 
>> colossal .
>> 
>> Fighting against that isn’t political. It’s patriotic.
>> 
>>  -mel
>> 
>>> On Apr 25, 2021, at 12:02 AM, Mark Foster  wrote:
>>> 
>>> 
 On 25/04/2021 3:24 am, Mel Beckman wrote:
 This doesn’t sound good, no matter how you slice it. The lack of 
 transparency with a civilian resource is troubling at a minimum. I’m going 
 to bogon this space as a defensive measure, until its real — and detailed 
 — purpose can be known. The secret places of our government have proven 
 themselves untrustworthy in the protection of citizens’ data and networks. 
 They tend to think they know “what’s good for” us.
 
  -mel
 
>>> Why does anyone on the Internet need to publish to your arbitrary 
>>> standards, what they intend to do with their IP address ranges?
>>> 
>>> Failure to advertise the IP address space to the Internet (until now, 
>>> perhaps) doesn't make the address space any less legitimate, and though I'd 
>>> expect the DoD to generally comply with all of the expected norms around 
>>> BGP arrangements and published whois details, at the end of the day, they 
>>> can nominate who should originate it from

Re: DoD IP Space

2021-04-25 Thread Mark Foster


Hi Mel,

I'd expect ARIN to hold them to account for complying with ARIN rules, 
if they are subject.  In years gone by, I have been able to contact US 
DoD organisations using published contact methods to address technical 
issues. So even if there's technical non-compliance (which i'd agree 
should be addressed), it could be a lot worse.


As for the DoD's accountability via your system of government, my view 
would be that instead of bogon-filtering addresses legitimately 
appearing in your BGP, with the justification being "they havn't 
before!", you could consider asking them via channels. Like 
https://open.defense.gov/transparency/foia.aspx for example.  But i'm 
not a citizen of the United States, so will happily plead ignorance as 
to whether this is likely to lead you to what you want to know or not.


In my country the government is also accountable to the people. But that 
doesn't mean I would expect an Internet Service Provider to deliberately 
sabotage the network access of their customers, either. Starts to feel 
like a net neutrality argument again.


Mark.

PS: If DoD make use of IP address space that they legitimately hold, i'm 
not sure you can call it a civilian resource, despite it interacting 
with civilian counterparts.  Any consumable held by a military 
organisation is a military resource and they'll make use of it based on 
their operational requirements. The best comparison I could think of, 
would be fuel (gasoline/petroleum/diesel/Jet-A1), all of which has both 
military and civilian application.


On 25/04/2021 7:40 pm, Mel Beckman wrote:

Mark,

ARIN rules require every IP space holder to publish accurate — and effective —  
Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I pointed out, and as 
you can test for yourself. Your expectation that the DOD will “generally comply 
with all of the expected norms” is sorely naive, and already disproven.

As far as “why does anyone on the Internet need to publish to your arbitrary 
standards”, you seem to forget that in the U.S., the government is accountable 
to the People. Where a private company may not have to explain its purposes, 
the government most certainly does in the private sector. With these IP spaces 
being thrust into the civilian realm, yes, they owe the citizenry an 
explanation of their actions, just as they would if they had started mounting 
missile launchers on highway overpasses. It’s a direct militarization of a 
civilian utility.

Keep in mind that the U.S. Government — under all administrations — has shown that 
it will abuse every technical advantage it can, as long as it can do so in secret. 
Perhaps you’ve forgotten James Clapper, the former director of national 
intelligence, who falsely testified to Congress that the government does “not 
wittingly” collect the telephone records of millions of Americans. And he was just 
the tip of the iceberg. Before Clapper under Obama there was the Bush 
administration’s Stellar Wind" warrantless surveillance program. The list of 
government abuse of civilian resources is colossal .

Fighting against that isn’t political. It’s patriotic.

  -mel


On Apr 25, 2021, at 12:02 AM, Mark Foster  wrote:



On 25/04/2021 3:24 am, Mel Beckman wrote:
This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us.

  -mel


Why does anyone on the Internet need to publish to your arbitrary standards, 
what they intend to do with their IP address ranges?

Failure to advertise the IP address space to the Internet (until now, perhaps) 
doesn't make the address space any less legitimate, and though I'd expect the 
DoD to generally comply with all of the expected norms around BGP arrangements 
and published whois details, at the end of the day, they can nominate who 
should originate it from their AS and as long as we can see who owns it 
it's just not our business.

Any organisation who's used DoD space in a way that's likely to conflict with, 
well, the DoD, gambled and lost.

Mark.

Re: DoD IP Space

2021-04-25 Thread Christian de Larrinaga via NANOG


Is the DoD still the owner?

On Sun 25 Apr 2021 at 10:24, Bill Woodcock  wrote:


On Apr 25, 2021, at 9:40 AM, Mel Beckman  
wrote:

It’s a direct militarization of a civilian utility.


I think I’d characterize it, rather, as a possible privatization 
of public property.


If someone builds a house in the middle of a public park, it’s 
not _what they’re doing in the house_ that concerns me.


-Bill



--
Christian de Larrinaga 
https://firsthand.net

Re: DoD IP Space

2021-04-25 Thread Bill Woodcock

> On Apr 25, 2021, at 9:40 AM, Mel Beckman  wrote:
> It’s a direct militarization of a civilian utility.

I think I’d characterize it, rather, as a possible privatization of public 
property.

If someone builds a house in the middle of a public park, it’s not _what 
they’re doing in the house_ that concerns me.

-Bill

signature.asc
Description: Message signed with OpenPGP

Re: DoD IP Space

2021-04-25 Thread Mel Beckman

Mark,

ARIN rules require every IP space holder to publish accurate — and effective —  
Admin, Tech, and Abuse POCs. The DOD hasn’t done this, as I pointed out, and as 
you can test for yourself. Your expectation that the DOD will “generally comply 
with all of the expected norms” is sorely naive, and already disproven.

As far as “why does anyone on the Internet need to publish to your arbitrary 
standards”, you seem to forget that in the U.S., the government is accountable 
to the People. Where a private company may not have to explain its purposes, 
the government most certainly does in the private sector. With these IP spaces 
being thrust into the civilian realm, yes, they owe the citizenry an 
explanation of their actions, just as they would if they had started mounting 
missile launchers on highway overpasses. It’s a direct militarization of a 
civilian utility. 

Keep in mind that the U.S. Government — under all administrations — has shown 
that it will abuse every technical advantage it can, as long as it can do so in 
secret. Perhaps you’ve forgotten James Clapper, the former director of national 
intelligence, who falsely testified to Congress that the government does “not 
wittingly” collect the telephone records of millions of Americans. And he was 
just the tip of the iceberg. Before Clapper under Obama there was the Bush 
administration’s Stellar Wind" warrantless surveillance program. The list of 
government abuse of civilian resources is colossal . 

Fighting against that isn’t political. It’s patriotic.

 -mel 

> On Apr 25, 2021, at 12:02 AM, Mark Foster  wrote:
> 
> 
>> On 25/04/2021 3:24 am, Mel Beckman wrote:
>> This doesn’t sound good, no matter how you slice it. The lack of 
>> transparency with a civilian resource is troubling at a minimum. I’m going 
>> to bogon this space as a defensive measure, until its real — and detailed — 
>> purpose can be known. The secret places of our government have proven 
>> themselves untrustworthy in the protection of citizens’ data and networks. 
>> They tend to think they know “what’s good for” us.
>> 
>>  -mel
>> 
> 
> Why does anyone on the Internet need to publish to your arbitrary standards, 
> what they intend to do with their IP address ranges?
> 
> Failure to advertise the IP address space to the Internet (until now, 
> perhaps) doesn't make the address space any less legitimate, and though I'd 
> expect the DoD to generally comply with all of the expected norms around BGP 
> arrangements and published whois details, at the end of the day, they can 
> nominate who should originate it from their AS and as long as we can see who 
> owns it it's just not our business.
> 
> Any organisation who's used DoD space in a way that's likely to conflict 
> with, well, the DoD, gambled and lost.
> 
> Mark.
>

Re: DoD IP Space

2021-04-25 Thread Mark Foster




On 25/04/2021 3:24 am, Mel Beckman wrote:
This doesn’t sound good, no matter how you slice it. The lack of 
transparency with a civilian resource is troubling at a minimum. I’m 
going to bogon this space as a defensive measure, until its real — and 
detailed — purpose can be known. The secret places of our government 
have proven themselves untrustworthy in the protection of citizens’ 
data and networks. They tend to think they know “what’s good for” us.


 -mel



Why does anyone on the Internet need to publish to your arbitrary 
standards, what they intend to do with their IP address ranges?


Failure to advertise the IP address space to the Internet (until now, 
perhaps) doesn't make the address space any less legitimate, and though 
I'd expect the DoD to generally comply with all of the expected norms 
around BGP arrangements and published whois details, at the end of the 
day, they can nominate who should originate it from their AS and as long 
as we can see who owns it it's just not our business.


Any organisation who's used DoD space in a way that's likely to conflict 
with, well, the DoD, gambled and lost.


Mark.

Re: DoD IP Space

Jason,

The government subsidizes farms, too. That doesn’t mean we let them be 
militarized.

Logic. :)

 -mel

On Apr 24, 2021, at 4:35 PM, Jason Biel  wrote:

The internet that is subsidized by that same Government

Logic.

On Sat, Apr 24, 2021 at 18:19 Mel Beckman 
mailto:m...@beckman.org>> wrote:
Bill,

It’s the INTERNET that is civilian, not the IP space. As long as that IP space 
was isolated to the .mil network, it was private space, as far as the Internet 
was concerned. Now DoD has moved it into the civilian Internet, and I treat 
them as potentially malicious as I do any other organization that lies, cheats, 
and steals the public trust.

 -mel

> On Apr 24, 2021, at 3:45 PM, William Herrin 
> mailto:b...@herrin.us>> wrote:
>
> On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman 
> mailto:m...@beckman.org>> wrote:
>> This doesn’t sound good, no matter how you slice it. The lack of
>> transparency with a civilian resource is troubling at a minimum.
>
> You do understand that the addresses in question are not and have
> never been "civilian." They came into DoD's possession when this was
> all still a military project funded by what's now DARPA.
>
> Personally, I think we may have an all time record for the largest
> honeypot ever constructed. I'd love to be a fly on that wall.
>
> Regards,
> Bill Herrin
>
>
>
> --
> William Herrin
> b...@herrin.us
> https://bill.herrin.us/

--
Jason

Re: DoD IP Space

Ryan,

My motives are not political. It doesn’t matter which party is behind this (and 
it looks like both would have to be, based on the timeline).

I’m treating this sudden advertisement of IP space as I would any other hostile 
actor, which NANOGers filter all the time. If the DOD comes clean and provides 
the required registered contact information, I might reconsider. But I’ve 
already called the published abuse contact number, and they say they don’t deal 
with “the public”. Until the DoD makes clear their intentions, blocking this IP 
space is the only sensible decision.

 -mel 

> On Apr 24, 2021, at 9:11 PM, Ryan Hamel  wrote:
> 
> Mel,
> 
> I hope you're not implementing this in an ISP network, it's not net neutral 
> if a carrier is making a (political) route/filtering decision. (Points to The 
> Great Firewall of China)
> 
> Ryan
> 
> -Original Message-
> From: NANOG  On Behalf Of Mel 
> Beckman
> Sent: Saturday, April 24, 2021 4:17 PM
> To: William Herrin 
> Cc: nanog@nanog.org
> Subject: Re: DoD IP Space
> 
> Bill,
> 
> It’s the INTERNET that is civilian, not the IP space. As long as that IP 
> space was isolated to the .mil network, it was private space, as far as the 
> Internet was concerned. Now DoD has moved it into the civilian Internet, and 
> I treat them as potentially malicious as I do any other organization that 
> lies, cheats, and steals the public trust.
> 
> -mel
> 
>> On Apr 24, 2021, at 3:45 PM, William Herrin  wrote:
>> 
>>> On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman  wrote:
>>> This doesn’t sound good, no matter how you slice it. The lack of 
>>> transparency with a civilian resource is troubling at a minimum.
>> 
>> You do understand that the addresses in question are not and have 
>> never been "civilian." They came into DoD's possession when this was 
>> all still a military project funded by what's now DARPA.
>> 
>> Personally, I think we may have an all time record for the largest 
>> honeypot ever constructed. I'd love to be a fly on that wall.
>> 
>> Regards,
>> Bill Herrin
>> 
>> 
>> 
>> --
>> William Herrin
>> b...@herrin.us
>> https://bill.herrin.us/
> 
>

RE: DoD IP Space

2021-04-24 Thread Ryan Hamel

Mel,

I hope you're not implementing this in an ISP network, it's not net neutral if 
a carrier is making a (political) route/filtering decision. (Points to The 
Great Firewall of China)

Ryan

-Original Message-
From: NANOG  On Behalf Of Mel Beckman
Sent: Saturday, April 24, 2021 4:17 PM
To: William Herrin 
Cc: nanog@nanog.org
Subject: Re: DoD IP Space

Bill,

It’s the INTERNET that is civilian, not the IP space. As long as that IP space 
was isolated to the .mil network, it was private space, as far as the Internet 
was concerned. Now DoD has moved it into the civilian Internet, and I treat 
them as potentially malicious as I do any other organization that lies, cheats, 
and steals the public trust.

 -mel

> On Apr 24, 2021, at 3:45 PM, William Herrin  wrote:
> 
> On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman  wrote:
>> This doesn’t sound good, no matter how you slice it. The lack of 
>> transparency with a civilian resource is troubling at a minimum.
> 
> You do understand that the addresses in question are not and have 
> never been "civilian." They came into DoD's possession when this was 
> all still a military project funded by what's now DARPA.
> 
> Personally, I think we may have an all time record for the largest 
> honeypot ever constructed. I'd love to be a fly on that wall.
> 
> Regards,
> Bill Herrin
> 
> 
> 
> --
> William Herrin
> b...@herrin.us
> https://bill.herrin.us/

Re: DoD IP Space

2021-04-24 Thread Jason Biel

The internet that is subsidized by that same Government

Logic.

On Sat, Apr 24, 2021 at 18:19 Mel Beckman  wrote:

> Bill,
>
> It’s the INTERNET that is civilian, not the IP space. As long as that IP
> space was isolated to the .mil network, it was private space, as far as the
> Internet was concerned. Now DoD has moved it into the civilian Internet,
> and I treat them as potentially malicious as I do any other organization
> that lies, cheats, and steals the public trust.
>
>  -mel
>
> > On Apr 24, 2021, at 3:45 PM, William Herrin  wrote:
> >
> > On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman  wrote:
> >> This doesn’t sound good, no matter how you slice it. The lack of
> >> transparency with a civilian resource is troubling at a minimum.
> >
> > You do understand that the addresses in question are not and have
> > never been "civilian." They came into DoD's possession when this was
> > all still a military project funded by what's now DARPA.
> >
> > Personally, I think we may have an all time record for the largest
> > honeypot ever constructed. I'd love to be a fly on that wall.
> >
> > Regards,
> > Bill Herrin
> >
> >
> >
> > --
> > William Herrin
> > b...@herrin.us
> > https://bill.herrin.us/
>
> --
Jason

Re: DoD IP Space

Bill,

It’s the INTERNET that is civilian, not the IP space. As long as that IP space 
was isolated to the .mil network, it was private space, as far as the Internet 
was concerned. Now DoD has moved it into the civilian Internet, and I treat 
them as potentially malicious as I do any other organization that lies, cheats, 
and steals the public trust.

 -mel

> On Apr 24, 2021, at 3:45 PM, William Herrin  wrote:
> 
> On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman  wrote:
>> This doesn’t sound good, no matter how you slice it. The lack of
>> transparency with a civilian resource is troubling at a minimum.
> 
> You do understand that the addresses in question are not and have
> never been "civilian." They came into DoD's possession when this was
> all still a military project funded by what's now DARPA.
> 
> Personally, I think we may have an all time record for the largest
> honeypot ever constructed. I'd love to be a fly on that wall.
> 
> Regards,
> Bill Herrin
> 
> 
> 
> -- 
> William Herrin
> b...@herrin.us
> https://bill.herrin.us/

Re: DoD IP Space

2021-04-24 Thread William Herrin

On Sat, Apr 24, 2021 at 8:26 AM Mel Beckman  wrote:
> This doesn’t sound good, no matter how you slice it. The lack of
> transparency with a civilian resource is troubling at a minimum.

You do understand that the addresses in question are not and have
never been "civilian." They came into DoD's possession when this was
all still a military project funded by what's now DARPA.

Personally, I think we may have an all time record for the largest
honeypot ever constructed. I'd love to be a fly on that wall.

Regards,
Bill Herrin

-- 
William Herrin
b...@herrin.us
https://bill.herrin.us/

Re: DoD IP Space

2021-04-24 Thread Mike Hammett

I encourage my competition to make equally arbitrary routing decisions. 

- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

- Original Message -

From: "Mel Beckman"  
To: "Mike Hammett"  
Cc: nanog@nanog.org, "John Curran"  
Sent: Saturday, April 24, 2021 10:53:26 AM 
Subject: Re: DoD IP Space 

In this specific case the group of self-described DOD network cowboys who, due 
to lack of transparency and public oversight, could be doing all manner of 
nefarious things with this IP space. It can’t help to let it in, and it can 
definitely hurt. 

But you know that. So why are you playing dumb? 

-mel 

On Apr 24, 2021, at 8:44 AM, Mike Hammett  wrote: 

"proven-malicious IP space owner" 

The DoD? 

- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

- Original Message -

From: "Mel Beckman"  
To: "Mike Hammett"  
Cc: nanog@nanog.org, "John Curran"  
Sent: Saturday, April 24, 2021 10:37:42 AM 
Subject: Re: DoD IP Space 

I will not permit traffic into my network whose proven-malicious IP space owner 
is devious about its purpose. You can, if you want. 

-mel 

On Apr 24, 2021, at 8:28 AM, Mike Hammett  wrote: 

Huh? 

- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

- Original Message -

From: "Mel Beckman"  
To: "John Curran"  
Cc: nanog@nanog.org 
Sent: Saturday, April 24, 2021 10:24:45 AM 
Subject: Re: DoD IP Space 

This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us. 

-mel 

On Apr 24, 2021, at 8:05 AM, John Curran  wrote: 

As noted - 
https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G

FYI, 
/John 

John Curran 
President and CEO 
American Registry for Internet Numbers 

On Jan 20, 2021, at 8:35 AM, John Curran  wrote: 

Tom – 

Most definitely: lack of routing history is not at all a reliable indicator of 
the potential for valid routing of a given IPv4 block in the future, so best 
practice suggest that allocated address space should not be blocked by others 
without specific cause. 

Doing otherwise opens one up to unexpected surprises when issued space suddenly 
becomes more active in routing and is yet is inexplicably unreachable for some 
destinations. 

/John 

On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote: 

Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + 
netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be 
treated as one. 

The DoD does not announce it to the DFZ, as is their choice, but nothing says 
they may not change that position tomorrow. There are plenty of subnets out 
there that are properly allocated by an RiR, but the assignees do not send them 
to the DFZ because of $reasons. 

In my opinion, creating bogon lists that include allocated but not advertised 
prefixes is poor practice that is likely to end up biting an operator at one 
point or another. 

On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov < xima...@gmail.com > wrote: 

Peace, 

On Tue, Nov 5, 2019, 4:55 PM David Conrad < d...@virtualized.org > wrote: 
> On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG < nanog@nanog.org > 
> wrote: 
>> This thread got me to wondering, is there any 
>> legitimate reason to see 22/8 on the public 
>> Internet? Or would it be okay to treat 22/8 
>> like a Bogon and drop it at the network edge? 
> 
> Given the transfer market for IPv4 addresses, 
> the spot price for IPv4 addresses, and the need 
> of even governments to find “free” (as in 
> unconstrained) money, I’d think treating any 
> legacy /8 as a bogon would not be prudent. 

It has been said before in this thread that the DoD actively uses this 
network internally. I believe if the DoD were to cut costs, they 
would be able to do it much more effectively in many other areas, and 
their IPv4 networks would be about the last thing they would think of 
(along with switching off ACs Bernard Ebbers-style). With that in 
mind, treating the DoD networks as bogons now makes total sense to me. 

-- 
Töma

Re: DoD IP Space

In this specific case the group of self-described DOD network cowboys who, due 
to lack of transparency and public oversight, could be doing all manner of 
nefarious things with this IP space. It can’t help to let it in, and it can 
definitely hurt.

But you know that. So why are you playing dumb?

 -mel

On Apr 24, 2021, at 8:44 AM, Mike Hammett  wrote:


"proven-malicious IP space owner"

The DoD?



-
Mike Hammett
Intelligent Computing Solutions<http://www.ics-il.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/ICSIL>[http://www.ics-il.com/images/googleicon.png]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/intelligent-computing-solutions>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/ICSIL>
Midwest Internet Exchange<http://www.midwest-ix.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/mdwestix>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/midwest-internet-exchange>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/mdwestix>
The Brothers WISP<http://www.thebrotherswisp.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/thebrotherswisp>[http://www.ics-il.com/images/youtubeicon.png]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg>

From: "Mel Beckman" 
To: "Mike Hammett" 
Cc: nanog@nanog.org, "John Curran" 
Sent: Saturday, April 24, 2021 10:37:42 AM
Subject: Re: DoD IP Space

I will not permit traffic into my network whose proven-malicious IP space owner 
is devious about its purpose. You can, if you want.

 -mel

On Apr 24, 2021, at 8:28 AM, Mike Hammett  wrote:


Huh?



-
Mike Hammett
Intelligent Computing Solutions<http://www.ics-il.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/ICSIL>[http://www.ics-il.com/images/googleicon.png]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/intelligent-computing-solutions>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/ICSIL>
Midwest Internet Exchange<http://www.midwest-ix.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/mdwestix>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/midwest-internet-exchange>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/mdwestix>
The Brothers WISP<http://www.thebrotherswisp.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/thebrotherswisp>[http://www.ics-il.com/images/youtubeicon.png]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg>

From: "Mel Beckman" 
To: "John Curran" 
Cc: nanog@nanog.org
Sent: Saturday, April 24, 2021 10:24:45 AM
Subject: Re: DoD IP Space

This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us.

 -mel

On Apr 24, 2021, at 8:05 AM, John Curran  wrote:


As noted - 
https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers

On Jan 20, 2021, at 8:35 AM, John Curran  wrote:


Tom –

Most definitely: lack of routing history is not at all a reliable indicator of 
the potential for valid routing of a given IPv4 block in the future, so best 
practice suggest that allocated address space should not be blocked by others 
without specific cause.

Doing otherwise opens one up to unexpected surprises when issued space suddenly 
becomes more active in routing and is yet is inexplicably unreachable for some 
destinations.

/John

On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote:


Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + 
netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be 
treated as one.

The DoD does not announce it to the DFZ, as is their choice, but nothing says 
they may not change that position tomorrow. There are plenty of subnets out 
there that are properly allocated by an RiR, but the assignees do not send them 
to the DFZ because of $reasons.

In my opinion, creating bogon lists that include allocated but not advertised 
prefixes is poor practice that is likely to end up biting an operator at one 
point or a

Re: DoD IP Space

2021-04-24 Thread Mike Hammett

"proven-malicious IP space owner" 

The DoD? 

- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

- Original Message -

From: "Mel Beckman"  
To: "Mike Hammett"  
Cc: nanog@nanog.org, "John Curran"  
Sent: Saturday, April 24, 2021 10:37:42 AM 
Subject: Re: DoD IP Space 

I will not permit traffic into my network whose proven-malicious IP space owner 
is devious about its purpose. You can, if you want. 

-mel 

On Apr 24, 2021, at 8:28 AM, Mike Hammett  wrote: 

Huh? 

- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

- Original Message -

From: "Mel Beckman"  
To: "John Curran"  
Cc: nanog@nanog.org 
Sent: Saturday, April 24, 2021 10:24:45 AM 
Subject: Re: DoD IP Space 

This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us. 

-mel 

On Apr 24, 2021, at 8:05 AM, John Curran  wrote: 

As noted - 
https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G

FYI, 
/John 

John Curran 
President and CEO 
American Registry for Internet Numbers 

On Jan 20, 2021, at 8:35 AM, John Curran  wrote: 

Tom – 

Most definitely: lack of routing history is not at all a reliable indicator of 
the potential for valid routing of a given IPv4 block in the future, so best 
practice suggest that allocated address space should not be blocked by others 
without specific cause. 

Doing otherwise opens one up to unexpected surprises when issued space suddenly 
becomes more active in routing and is yet is inexplicably unreachable for some 
destinations. 

/John 

On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote: 

Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + 
netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be 
treated as one. 

The DoD does not announce it to the DFZ, as is their choice, but nothing says 
they may not change that position tomorrow. There are plenty of subnets out 
there that are properly allocated by an RiR, but the assignees do not send them 
to the DFZ because of $reasons. 

In my opinion, creating bogon lists that include allocated but not advertised 
prefixes is poor practice that is likely to end up biting an operator at one 
point or another. 

On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov < xima...@gmail.com > wrote: 

Peace, 

On Tue, Nov 5, 2019, 4:55 PM David Conrad < d...@virtualized.org > wrote: 
> On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG < nanog@nanog.org > 
> wrote: 
>> This thread got me to wondering, is there any 
>> legitimate reason to see 22/8 on the public 
>> Internet? Or would it be okay to treat 22/8 
>> like a Bogon and drop it at the network edge? 
> 
> Given the transfer market for IPv4 addresses, 
> the spot price for IPv4 addresses, and the need 
> of even governments to find “free” (as in 
> unconstrained) money, I’d think treating any 
> legacy /8 as a bogon would not be prudent. 

It has been said before in this thread that the DoD actively uses this 
network internally. I believe if the DoD were to cut costs, they 
would be able to do it much more effectively in many other areas, and 
their IPv4 networks would be about the last thing they would think of 
(along with switching off ACs Bernard Ebbers-style). With that in 
mind, treating the DoD networks as bogons now makes total sense to me. 

-- 
Töma

Re: DoD IP Space

I will not permit traffic into my network whose proven-malicious IP space owner 
is devious about its purpose. You can, if you want.

 -mel

On Apr 24, 2021, at 8:28 AM, Mike Hammett  wrote:

Huh?

-
Mike Hammett
Intelligent Computing Solutions<http://www.ics-il.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/ICSIL>[http://www.ics-il.com/images/googleicon.png]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/intelligent-computing-solutions>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/ICSIL>
Midwest Internet Exchange<http://www.midwest-ix.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/mdwestix>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/midwest-internet-exchange>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/mdwestix>
The Brothers WISP<http://www.thebrotherswisp.com/>
[http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/thebrotherswisp>[http://www.ics-il.com/images/youtubeicon.png]<https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg>

From: "Mel Beckman" 
To: "John Curran" 
Cc: nanog@nanog.org
Sent: Saturday, April 24, 2021 10:24:45 AM
Subject: Re: DoD IP Space

This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us.

 -mel

On Apr 24, 2021, at 8:05 AM, John Curran  wrote:

As noted - 
https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers

On Jan 20, 2021, at 8:35 AM, John Curran  wrote:

Tom –

Most definitely: lack of routing history is not at all a reliable indicator of 
the potential for valid routing of a given IPv4 block in the future, so best 
practice suggest that allocated address space should not be blocked by others 
without specific cause.

Doing otherwise opens one up to unexpected surprises when issued space suddenly 
becomes more active in routing and is yet is inexplicably unreachable for some 
destinations.

/John

On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote:

Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + 
netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be 
treated as one.

The DoD does not announce it to the DFZ, as is their choice, but nothing says 
they may not change that position tomorrow. There are plenty of subnets out 
there that are properly allocated by an RiR, but the assignees do not send them 
to the DFZ because of $reasons.

In my opinion, creating bogon lists that include allocated but not advertised 
prefixes is poor practice that is likely to end up biting an operator at one 
point or another.

On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov 
mailto:xima...@gmail.com>> wrote:
Peace,

On Tue, Nov 5, 2019, 4:55 PM David Conrad 
mailto:d...@virtualized.org>> wrote:
> On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG 
> mailto:nanog@nanog.org>> wrote:
>> This thread got me to wondering, is there any
>> legitimate reason to see 22/8 on the public
>> Internet?  Or would it be okay to treat 22/8
>> like a Bogon and drop it at the network edge?
>
> Given the transfer market for IPv4 addresses,
> the spot price for IPv4 addresses, and the need
> of even governments to find “free” (as in
> unconstrained) money, I’d think treating any
> legacy /8 as a bogon would not be prudent.

It has been said before in this thread that the DoD actively uses this
network internally.  I believe if the DoD were to cut costs, they
would be able to do it much more effectively in many other areas, and
their IPv4 networks would be about the last thing they would think of
(along with switching off ACs Bernard Ebbers-style).  With that in
mind, treating the DoD networks as bogons now makes total sense to me.

--
Töma

Re: DoD IP Space

2021-04-24 Thread Mike Hammett

Huh? 

- 
Mike Hammett 
Intelligent Computing Solutions 

Midwest Internet Exchange 

The Brothers WISP 

- Original Message -

From: "Mel Beckman"  
To: "John Curran"  
Cc: nanog@nanog.org 
Sent: Saturday, April 24, 2021 10:24:45 AM 
Subject: Re: DoD IP Space 

This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us. 

-mel 

On Apr 24, 2021, at 8:05 AM, John Curran  wrote: 

As noted - 
https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G

FYI, 
/John 

John Curran 
President and CEO 
American Registry for Internet Numbers 

On Jan 20, 2021, at 8:35 AM, John Curran  wrote: 

Tom – 

Most definitely: lack of routing history is not at all a reliable indicator of 
the potential for valid routing of a given IPv4 block in the future, so best 
practice suggest that allocated address space should not be blocked by others 
without specific cause. 

Doing otherwise opens one up to unexpected surprises when issued space suddenly 
becomes more active in routing and is yet is inexplicably unreachable for some 
destinations. 

/John 

On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote: 

Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + 
netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be 
treated as one. 

The DoD does not announce it to the DFZ, as is their choice, but nothing says 
they may not change that position tomorrow. There are plenty of subnets out 
there that are properly allocated by an RiR, but the assignees do not send them 
to the DFZ because of $reasons. 

In my opinion, creating bogon lists that include allocated but not advertised 
prefixes is poor practice that is likely to end up biting an operator at one 
point or another. 

On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov < xima...@gmail.com > wrote: 

Peace, 

On Tue, Nov 5, 2019, 4:55 PM David Conrad < d...@virtualized.org > wrote: 
> On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG < nanog@nanog.org > 
> wrote: 
>> This thread got me to wondering, is there any 
>> legitimate reason to see 22/8 on the public 
>> Internet? Or would it be okay to treat 22/8 
>> like a Bogon and drop it at the network edge? 
> 
> Given the transfer market for IPv4 addresses, 
> the spot price for IPv4 addresses, and the need 
> of even governments to find “free” (as in 
> unconstrained) money, I’d think treating any 
> legacy /8 as a bogon would not be prudent. 

It has been said before in this thread that the DoD actively uses this 
network internally. I believe if the DoD were to cut costs, they 
would be able to do it much more effectively in many other areas, and 
their IPv4 networks would be about the last thing they would think of 
(along with switching off ACs Bernard Ebbers-style). With that in 
mind, treating the DoD networks as bogons now makes total sense to me. 

-- 
Töma

Re: DoD IP Space

This doesn’t sound good, no matter how you slice it. The lack of transparency 
with a civilian resource is troubling at a minimum. I’m going to bogon this 
space as a defensive measure, until its real — and detailed — purpose can be 
known. The secret places of our government have proven themselves untrustworthy 
in the protection of citizens’ data and networks. They tend to think they know 
“what’s good for” us.

 -mel

On Apr 24, 2021, at 8:05 AM, John Curran  wrote:

As noted - 
https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers

On Jan 20, 2021, at 8:35 AM, John Curran  wrote:

Tom –

Most definitely: lack of routing history is not at all a reliable indicator of 
the potential for valid routing of a given IPv4 block in the future, so best 
practice suggest that allocated address space should not be blocked by others 
without specific cause.

Doing otherwise opens one up to unexpected surprises when issued space suddenly 
becomes more active in routing and is yet is inexplicably unreachable for some 
destinations.

/John

On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote:

Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + 
netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be 
treated as one.

The DoD does not announce it to the DFZ, as is their choice, but nothing says 
they may not change that position tomorrow. There are plenty of subnets out 
there that are properly allocated by an RiR, but the assignees do not send them 
to the DFZ because of $reasons.

In my opinion, creating bogon lists that include allocated but not advertised 
prefixes is poor practice that is likely to end up biting an operator at one 
point or another.

On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov 
mailto:xima...@gmail.com>> wrote:
Peace,

On Tue, Nov 5, 2019, 4:55 PM David Conrad 
mailto:d...@virtualized.org>> wrote:
> On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG 
> mailto:nanog@nanog.org>> wrote:
>> This thread got me to wondering, is there any
>> legitimate reason to see 22/8 on the public
>> Internet?  Or would it be okay to treat 22/8
>> like a Bogon and drop it at the network edge?
>
> Given the transfer market for IPv4 addresses,
> the spot price for IPv4 addresses, and the need
> of even governments to find “free” (as in
> unconstrained) money, I’d think treating any
> legacy /8 as a bogon would not be prudent.

It has been said before in this thread that the DoD actively uses this
network internally.  I believe if the DoD were to cut costs, they
would be able to do it much more effectively in many other areas, and
their IPv4 networks would be about the last thing they would think of
(along with switching off ACs Bernard Ebbers-style).  With that in
mind, treating the DoD networks as bogons now makes total sense to me.

--
Töma

Re: DoD IP Space

2021-04-24 Thread John Curran

As noted - 
https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/#click=https://t.co/mVh26yBq9G

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers

On Jan 20, 2021, at 8:35 AM, John Curran  wrote:

Tom –

Most definitely: lack of routing history is not at all a reliable indicator of 
the potential for valid routing of a given IPv4 block in the future, so best 
practice suggest that allocated address space should not be blocked by others 
without specific cause.

Doing otherwise opens one up to unexpected surprises when issued space suddenly 
becomes more active in routing and is yet is inexplicably unreachable for some 
destinations.

/John

On Nov 5, 2019, at 10:38 AM, Tom Beecher  wrote:

Using the generally accepted definition of a bogon ( RFC 1918 / 5735 / 6598 + 
netblock not allocated by an RiR ), 22/8 is not a bogon and shouldn't be 
treated as one.

The DoD does not announce it to the DFZ, as is their choice, but nothing says 
they may not change that position tomorrow. There are plenty of subnets out 
there that are properly allocated by an RiR, but the assignees do not send them 
to the DFZ because of $reasons.

In my opinion, creating bogon lists that include allocated but not advertised 
prefixes is poor practice that is likely to end up biting an operator at one 
point or another.

On Tue, Nov 5, 2019 at 9:45 AM Töma Gavrichenkov 
mailto:xima...@gmail.com>> wrote:
Peace,

On Tue, Nov 5, 2019, 4:55 PM David Conrad 
mailto:d...@virtualized.org>> wrote:
> On Nov 4, 2019, at 10:56 PM, Grant Taylor via NANOG 
> mailto:nanog@nanog.org>> wrote:
>> This thread got me to wondering, is there any
>> legitimate reason to see 22/8 on the public
>> Internet?  Or would it be okay to treat 22/8
>> like a Bogon and drop it at the network edge?
>
> Given the transfer market for IPv4 addresses,
> the spot price for IPv4 addresses, and the need
> of even governments to find “free” (as in
> unconstrained) money, I’d think treating any
> legacy /8 as a bogon would not be prudent.

It has been said before in this thread that the DoD actively uses this
network internally.  I believe if the DoD were to cut costs, they
would be able to do it much more effectively in many other areas, and
their IPv4 networks would be about the last thing they would think of
(along with switching off ACs Bernard Ebbers-style).  With that in
mind, treating the DoD networks as bogons now makes total sense to me.

--
Töma

Re: DoD IP Space

2021-03-11 Thread Christopher Morrow

On Thu, Mar 11, 2021 at 10:54 AM j k  wrote:
>
> Two questions...
>
> 1. How many on this list already have dual-stack or IPv6 only in operation?

we're coming up on the 10yr anniversary of 'world ipv6 day'.. so I
would HOPE 'lots' :)
probably that's not entirely a good 'hope' :(

> 2. If you are running IPv4 only, and a major service was to switch to IPv6 
> only,..
>  a. How fast would you move to a dual-stack of IPv6 only?
>  b. What would it impact your customers?
>  c. How would it impact your business?
>

This is REALY now a days: "people will learn when they get bit"
much like 'gosh, password is not a great password, who knew?'
 or: "well, who needs windows updates anyway?"

evangelizing ipv6 is... not worth the effort :( because if you didn't
get them memo over the last 10yrs
you are verizon and you are not changing stance until something
significant enough bites you.
(yearly email about verizon residential service and lack of ipv6 support.. )

Re: DoD IP Space

2021-03-11 Thread j k

Two questions...

1. How many on this list already have dual-stack or IPv6 only in operation?

2. If you are running IPv4 only, and a major service was to switch to IPv6
only,..
 a. How fast would you move to a dual-stack of IPv6 only?
 b. What would it impact your customers?
 c. How would it impact your business?

Joe Klein

"inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1)
"*I skate to where the puck is going to be, not to where it has been."
-- *Wayne
Gretzky
"I never lose. I either win or learn" - Nelson Mandela


On Thu, Feb 11, 2021 at 12:56 PM William Herrin  wrote:

> On Thu, Feb 11, 2021 at 6:13 AM Izaac  wrote:
> > On Wed, Feb 10, 2021 at 10:38:00AM -0800, William Herrin wrote:
> > > None whatsoever. You just have to be really big.
> >
> > Hi Beel,
>
> That was unnecessary. Sorry I used an S instead of a Z.
>
> > Thanks for backing me up with an example of an organization with
> > competent network engineering.  Their ability to almost infinitely
> > leverage the existing rfc1918 address space to serve an appreciable
> > fraction of all Internet attached hosts is a real demonstration of the
> > possible.
>
> Except they don't. One of the reasons you can't put vms in multiple
> regions into the same VPC is they don't have enough IP addresses to
> uniquely address the backend hosts in every region. They end up with a
> squirrelly VPC peering thing they relies on multiple gateway hosts to
> overcome the address partitioning from overlapping RFC1918.
>
> In other words, it proves the exact opposite of your assertion.
>
> Regards,
> Bill Herrin
>
>
>
> --
> William Herrin
> b...@herrin.us
> https://bill.herrin.us/
>

Re: DoD IP Space

2021-02-27 Thread Daniel Seagraves



> On Feb 26, 2021, at 7:50 PM, Mel Beckman  wrote:
> 
> IPv6. The protocol of the future, and always will be :)

“Why be part of the solution when there’s good money to be made in prolonging 
the problem?”

Re: DoD IP Space

2021-02-26 Thread Mel Beckman

I remember. And I have the HE.net Guru Badge to prove it :)

And don’t forget the World IPv6 Launch in 2012. 

IPv6. The protocol of the future, and always will be :)


-mel via cell

> On Feb 26, 2021, at 3:49 PM, Jay Hennigan  wrote:
> 
> On 2/13/21 18:24, Mark Foster wrote:
> 
>> So the business case will be the 'killer app' or perhaps 'killer service' 
>> that's IPv6-only and that'll provide a business reason.
>> But chicken and egg.. who wants to run a service that's IPv6-only and miss 
>> out on such a big userbase?
> 
> Am I the only one who remembers "The Great IPv6 Experiment" from way back in 
> 2007?
> 
> -- 
> Jay Hennigan - j...@west.net
> Network Engineering - CCIE #7880
> 503 897-8550 - WB6RDV

Re: DoD IP Space

2021-02-26 Thread Jay Hennigan


On 2/13/21 18:24, Mark Foster wrote:


So the business case will be the 'killer app' or perhaps 'killer service' 
that's IPv6-only and that'll provide a business reason.

But chicken and egg.. who wants to run a service that's IPv6-only and miss out 
on such a big userbase?


Am I the only one who remembers "The Great IPv6 Experiment" from way 
back in 2007?


--
Jay Hennigan - j...@west.net
Network Engineering - CCIE #7880
503 897-8550 - WB6RDV

Re: DoD IP Space

2021-02-15 Thread bzs



In my humble but correct opinion one of the things which sabotages
these efforts is an aversion to any solution which doesn't feel like
it would work quickly and decisively (ask Bezos to offer a discount to
anyone using IPv6 to order on Amazon???)

I remember back in ~2003 on the Anti-Spam Research Group some
interesting ideas* being shot down because that would take ten years
to deploy! 2003.

And here we are about 25 years into IPv6 still looking for that silver
bullet.

What might be more useful would be forming some sort of group with the
understanding that they might produce a ten year or longer timeline of
steps which might more fully deploy IPv6.

* In all honesty they weren't all that interesting. But for example
"we need to respecify SMTP to stop spam!" had a half-life of about 60
minutes dying on the rebuttal that even if you did that it would take
TEN YEARS to get wide adoption of an SMTP replacement. I never saw how
such proposals would help with spam but ok perhaps they were
discouraged by the rebuts.

-- 
-Barry Shein

Software Tool & Die| b...@theworld.com | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD   | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*

Re: DoD IP Space

2021-02-15 Thread Randy Bush

> it’s unclear if there’s been any systematic look-back or institutional
> learning coming out of the entire experience.

i am always impressed by optimism in the face of cold reality

Re: DoD IP Space

2021-02-15 Thread Mark Andrews

1993 matches my recollections as well.

Network Working Group S. Bradner
Internet draftHarvard University
   A. Mankin
 NRL
  September 1994


 
The Recommendation for the IP Next Generation Protocol


  



> On 16 Feb 2021, at 04:28, Mel Beckman  wrote:
> 
> LOL! Well, Mike says “definitely at least 1993”, whereas Wikipedia itself 
> says that Wikipedia cannot be trusted. Mike, to my knowledge, has never 
> admitted being wrong. So I’m going with Mike :)
> 
> I think it was Al Gore who first proposed IPv6, right Mike? :)
> 
>  -mel beckman
> 
>> On Feb 15, 2021, at 6:36 AM, Kenneth J. Dupuis  wrote:
>> 
>> 
>> 1995? https://en.m.wikipedia.org/wiki/IPv6
>> 
>> On Feb 11, 2021 8:51 PM, Michael Thomas  wrote:
>> 
>> On 2/11/21 5:41 PM, Izaac wrote: 
>> > 
>> >> IPv6 restores that ability and RFC-1918 is a bandaid for an obsolete 
>> >> protocol. 
>> > So, in your mind, IPv4 was "obsolete" in 1996 -- almost three years 
>> > before IPv6 was even specified?  Fascinating.  I could be in no way 
>> > mistaken for an IPv4/NAT apologist, but that one's new on me. 
>> 
>> ipv6 was on my radar in the early 90's. it was definitely at least 1993, 
>> maybe earlier. 
>> 
>> Mike 
>> 
>> 

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742  INTERNET: ma...@isc.org

Re: DoD IP Space

2021-02-15 Thread Gary Buhrmaster

On Mon, Feb 15, 2021 at 9:36 PM Joe Loiacono  wrote:

> V8!  heh ... wow hadn't thought of that for a while ...

... Slaps forehead and says:  "Wow, I could've had a V8!"

Re: DoD IP Space

2021-02-15 Thread Joe Loiacono


V8!  heh ... wow hadn't thought of that for a while ...

On 2/15/2021 3:39 PM, Valdis Klētnieks wrote:

On Mon, 15 Feb 2021 10:51:51 -0800, Sabri Berisha said:


Well, considering this RIPE article that talked about IPv7 already..

https://lists.ripe.net/pipermail/ripe-org-closed/1993/msg00024.html

Bonus points for those who remember/know where v5 and v8 were from :)

Re: DoD IP Space

2021-02-15 Thread Fred Baker

Streams Transport and PIP.

Good grief. V7 was Robert Ullman’s CATNIP. He wanted to sell hardware to 
everyone, and V7 was the interchange protocol between IPv4, IPX, and CLNS.

Sent using a machine that autocorrects in interesting ways...

> On Feb 15, 2021, at 12:41 PM, Valdis Klētnieks  
> wrote:
> 
> On Mon, 15 Feb 2021 10:51:51 -0800, Sabri Berisha said:
> 
>> Well, considering this RIPE article that talked about IPv7 already..
>> 
>> https://lists.ripe.net/pipermail/ripe-org-closed/1993/msg00024.html
> 
> Bonus points for those who remember/know where v5 and v8 were from :)

V5 was

Re: DoD IP Space

2021-02-15 Thread james.cut...@consultant.com

It’s Dead, Jim — Speaking of V8.  I’m glad Outlook had a Delete button.

> On Feb 15, 2021, at 3:39 PM, Valdis Klētnieks  wrote:
> 
> On Mon, 15 Feb 2021 10:51:51 -0800, Sabri Berisha said:
> 
>> Well, considering this RIPE article that talked about IPv7 already..
>> 
>> https://lists.ripe.net/pipermail/ripe-org-closed/1993/msg00024.html
> 
> Bonus points for those who remember/know where v5 and v8 were from :)

Re: DoD IP Space

2021-02-15 Thread Valdis Klētnieks

On Mon, 15 Feb 2021 10:51:51 -0800, Sabri Berisha said:

> Well, considering this RIPE article that talked about IPv7 already..
>
> https://lists.ripe.net/pipermail/ripe-org-closed/1993/msg00024.html

Bonus points for those who remember/know where v5 and v8 were from :)


pgpdrYkPJgCF0.pgp
Description: PGP signature

Re: DoD IP Space

2021-02-15 Thread Geoff Mulligan

Actually John - IPng started out being called IPv7, but we caught the 
mistake and renamed it IPv6.  Whew :-)


Geoff


On 2/15/21 8:33 AM, John Curran wrote:
On 15 Feb 2021, at 2:01 AM, Mark Andrews > wrote:

...
Complain to your vendors about not implementing RFC 8305, RFC 6724, and
RFC 7078.  RFC 8305 or RFC6724 + RFC 7078 would fix your issue.

Thats Happy Eyeballs and tuneable address selection rules.


Mark -

You’ve properly pointed out IPv6 can indeed be readily & safely 
deployed today using modern equipment that supports a reasonable 
transition approach… full agreement there.


Interestingly enough, you’ve also pointed out the not-so-secret reason 
why it's taken so long to get sizable deployment of IPv6 – that is, 
despite us knowing that we needed "a straightforward transition plan” 
on day one that documented how to move from IPv4 to IPng (aka IPv6), 
we opted in 1995 to select a next generation protocol which lacked any 
meaningful transition plan and instead left that nasty transition 
topic as an exercise for the reader and/or addressed by postulated 
outputs from newly-defined working groups…  thus the underlying reason 
for the lost decades of creative engineering efforts in gap-filling by 
those who came after and had to actually build working networks and 
applications using IPv6.


For what it’s worth, I do think we’re finally 98 or 99% of the way 
there, but it has resulted some very real costs - rampant industry 
confusion, loss of standards credibility, etc.  There’s some real 
lessons to be had here – as one who was in the IP Directorate at the 
time (and thus sharing in the blame), I know I would have done quite a 
bit differently, but it’s unclear if there’s been any systematic 
look-back or institutional learning coming out of the entire experience.


FYI,
/John

Re: DoD IP Space

2021-02-15 Thread Sabri Berisha

- On Feb 15, 2021, at 9:28 AM, mel  wrote: 

Hi,

> LOL! Well, Mike says “definitely at least 1993”, whereas Wikipedia itself says
> that Wikipedia cannot be trusted. Mike, to my knowledge, has never admitted
> being wrong. So I’m going with Mike :)

Well, considering this RIPE article that talked about IPv7 already..

https://lists.ripe.net/pipermail/ripe-org-closed/1993/msg00024.html

I'd say: myth plausible.

> I think it was Al Gore who first proposed IPv6, right Mike? :)

Myth busted. He invented the internet. IPv6 was invented by his intern.

Thanks,

Sabri

Re: DoD IP Space

2021-02-15 Thread Mel Beckman

LOL! Well, Mike says “definitely at least 1993”, whereas Wikipedia itself says 
that Wikipedia cannot be trusted. Mike, to my knowledge, has never admitted 
being wrong. So I’m going with Mike :)

I think it was Al Gore who first proposed IPv6, right Mike? :)

 -mel beckman

On Feb 15, 2021, at 6:36 AM, Kenneth J. Dupuis  wrote:

1995? https://en.m.wikipedia.org/wiki/IPv6

On Feb 11, 2021 8:51 PM, Michael Thomas  wrote:

On 2/11/21 5:41 PM, Izaac wrote:
>
>> IPv6 restores that ability and RFC-1918 is a bandaid for an obsolete 
>> protocol.
> So, in your mind, IPv4 was "obsolete" in 1996 -- almost three years
> before IPv6 was even specified?  Fascinating.  I could be in no way
> mistaken for an IPv4/NAT apologist, but that one's new on me.

ipv6 was on my radar in the early 90's. it was definitely at least 1993,
maybe earlier.

Mike

Re: DoD IP Space

2021-02-15 Thread William Herrin

On Mon, Feb 15, 2021 at 7:49 AM Valdis Klētnieks
 wrote:
> On Sun, 14 Feb 2021 22:25:56 -0800, William Herrin said:
> > This particular problem could be quickly resolved if the OSes still
> > getting updates were updated to default name resolution to prioritize
> > the IPv4 addresses instead. That would allow broken IPv6
> > configurations to exist without breaking the user's entire Internet
> > experience. Which would allow them to leave it turned on so that it
> > resumes working when the error is eventually found and fixed.
>
> Oh, come on Bill.  This ain't your first rodeo.  You know damned well
> that if we do that, the errors are in fact *not* eventually found and fixed.

I don't know that and neither do you. That remains an untested theory.
What I do know, with the perfection of 20/20 hindsight, is that
v6-first has impeded deployment for two decades by routinely giving
folks a reason to turn IPv6 back off.

Hard headed.

Regards,
Bill Herrin




-- 
William Herrin
b...@herrin.us
https://bill.herrin.us/

Re: DoD IP Space

2021-02-15 Thread Valdis Klētnieks

On Sun, 14 Feb 2021 22:25:56 -0800, William Herrin said:

> This particular problem could be quickly resolved if the OSes still
> getting updates were updated to default name resolution to prioritize
> the IPv4 addresses instead. That would allow broken IPv6
> configurations to exist without breaking the user's entire Internet
> experience. Which would allow them to leave it turned on so that it
> resumes working when the error is eventually found and fixed.

Oh, come on Bill.  This ain't your first rodeo.  You know damned well
that if we do that, the errors are in fact *not* eventually found and fixed.

In addition, if you do that, even once the error is fixed, the box will
not know about that and will continue to use the IPv4 addresses.

Re: DoD IP Space

2021-02-15 Thread John Curran

On 15 Feb 2021, at 2:01 AM, Mark Andrews  wrote:
> ...
> Complain to your vendors about not implementing RFC 8305, RFC 6724, and
> RFC 7078.  RFC 8305 or RFC6724 + RFC 7078 would fix your issue.
> 
> Thats Happy Eyeballs and tuneable address selection rules.

Mark - 

You’ve properly pointed out IPv6 can indeed be readily & safely 
deployed today using modern equipment that supports a reasonable transition 
approach… full agreement there. 

Interestingly enough, you’ve also pointed out the not-so-secret reason 
why it's taken so long to get sizable deployment of IPv6 – that is, despite us 
knowing that we needed "a straightforward transition plan” on day one that 
documented how to move from IPv4 to IPng (aka IPv6), we opted in 1995 to select 
a next generation protocol which lacked any meaningful transition plan and 
instead left that nasty transition topic as an exercise for the reader and/or 
addressed by postulated outputs from newly-defined working groups…  thus the 
underlying reason for the lost decades of creative engineering efforts in 
gap-filling by those who came after and had to actually build working networks 
and applications using IPv6.

For what it’s worth, I do think we’re finally 98 or 99% of the way 
there, but it has resulted some very real costs - rampant industry confusion, 
loss of standards credibility, etc.  There’s some real lessons to be had here – 
as one who was in the IP Directorate at the time (and thus sharing in the 
blame), I know I would have done quite a bit differently, but it’s unclear if 
there’s been any systematic look-back or institutional learning coming out of 
the entire experience.

FYI,
/John

Re: DoD IP Space

2021-02-15 Thread james.cut...@consultant.com

On Feb 11, 2021, at 9:01 PM, Kenneth J. Dupuis  wrote:
> 
> 1995? https://en.m.wikipedia.org/wiki/IPv6
> 
> On Feb 11, 2021 8:51 PM, Michael Thomas  wrote:
> 
> On 2/11/21 5:41 PM, Izaac wrote:
> >
> >> IPv6 restores that ability and RFC-1918 is a bandaid for an obsolete 
> >> protocol.
> > So, in your mind, IPv4 was "obsolete" in 1996 -- almost three years
> > before IPv6 was even specified?  Fascinating.  I could be in no way
> > mistaken for an IPv4/NAT apologist, but that one's new on me.
> 
> ipv6 was on my radar in the early 90's. it was definitely at least 1993, 
> maybe earlier.
> 
> Mike
> 
Back then some thought it would be more like DECnet Phase V.

Re: DoD IP Space

2021-02-15 Thread Kenneth J. Dupuis

1995? https://en.m.wikipedia.org/wiki/IPv6On Feb 11, 2021 8:51 PM, Michael Thomas  wrote:
On 2/11/21 5:41 PM, Izaac wrote:
>
>> IPv6 restores that ability and RFC-1918 is a bandaid for an obsolete protocol.
> So, in your mind, IPv4 was "obsolete" in 1996 -- almost three years
> before IPv6 was even specified?  Fascinating.  I could be in no way
> mistaken for an IPv4/NAT apologist, but that one's new on me.

ipv6 was on my radar in the early 90's. it was definitely at least 1993, 
maybe earlier.

Mike

Re: DoD IP Space

2021-02-15 Thread Mark Tinka





On 2/15/21 09:59, na...@jack.fr.eu.org wrote:


Yet both ps5 and xbox series x have ipv6 support

A console released in 2013 do not, but its successor released in 2020 
have it


How wild is this, I wonder why ?


IPv6 also runs on hardware that was shipped as far back as 2003, if not 
earlier.


Mark.

Re: DoD IP Space

2021-02-15 Thread William Herrin

On Sun, Feb 14, 2021 at 11:01 PM Mark Andrews  wrote:
> Complain to your vendors about not implementing RFC 8305, RFC 6724, and
> RFC 7078.  RFC 8305 or RFC6724 + RFC 7078 would fix your issue.
>
> Thats Happy Eyeballs and tuneable address selection rules.
>
> You don’t have to perform the naive connection from getaddrinfo() man page.

Hi Mark,

When I said bull-headed, this is exactly what I had in mind. Happy
eyeballs and things like
https://bill.herrin.us/freebies/libeasyv6-0.1/ aren't first-class
citizens in the APIs. Their code has to be independently added to each
application individually. Getaddrinfo() is core standard. Fix the
problem in the place that fixes it in every place or else it's never
really fixed.

Regards,
Bill Herrin

-- 
William Herrin
b...@herrin.us
https://bill.herrin.us/

Re: DoD IP Space

2021-02-15 Thread nanog


Yet both ps5 and xbox series x have ipv6 support

A console released in 2013 do not, but its successor released in 2020 
have it


How wild is this, I wonder why ?

On 2/15/21 5:25 AM, Mark Tinka wrote:
I mean, there's a reason that 
in 2021, PS4 still does not support IPv6.


Mark.

Re: DoD IP Space

2021-02-14 Thread Mark Andrews



> On 15 Feb 2021, at 17:25, William Herrin  wrote:
> 
> On Sun, Feb 14, 2021 at 8:27 PM Mark Tinka  wrote:
>> Dropping a few feet from cloud nine, there, really, is no other thing
>> that will facilitate or hold back the adoption of IPv6, like money.
> 
> Well actually, that's not entirely true. One thing holding back IPv6
> is the unfortunately routine need to turn it off in order to get one
> or another IPv4 thing back working again. Like the disney thing
> earlier in this thread. Or like my experience yesterday where I had to
> disable IPv6 to fetch files on a particular server because SLAAC was
> serving up invalid addresses but the app insisted on trying all 8 IPv6
> addresses before it would attempt any of the IPv4 addresses. And of
> course I can't call my ISP and say: you're causing my Linux box to
> pick up bad IPv6 addresses. Front line support can barely handle IPv4
> and Windows.
> 
> I stuck with it for a couple hours and figured out how to disable
> SLAAC without disabling DHCP-PD so that I could turn IPv6 back on with
> addresses which worked. But really, how many people are going to do
> that? Most tick the IPv6 checkbox to off and are done with it.
> 
> This particular problem could be quickly resolved if the OSes still
> getting updates were updated to default name resolution to prioritize
> the IPv4 addresses instead. That would allow broken IPv6
> configurations to exist without breaking the user's entire Internet
> experience. Which would allow them to leave it turned on so that it
> resumes working when the error is eventually found and fixed.
> 
> Prioritizing IPv6 over IPv4 for newly initiated connections is one of
> the trifecta of critical design errors that have been killing IPv6 for
> two decades. One of the two that if key folks weren't being so
> bull-headed about it, it would be trivial to fix.

Complain to your vendors about not implementing RFC 8305, RFC 6724, and
RFC 7078.  RFC 8305 or RFC6724 + RFC 7078 would fix your issue.

Thats Happy Eyeballs and tuneable address selection rules.

You don’t have to perform the naive connection from getaddrinfo() man page.

   struct addrinfo hints, *res, *res0;
   int error;
   int s;
   const char *cause = NULL;

   memset(, 0, sizeof(hints));
   hints.ai_family = PF_UNSPEC;
   hints.ai_socktype = SOCK_STREAM;
   error = getaddrinfo("www.kame.net", "http", , );
   if (error) {
   errx(1, "%s", gai_strerror(error));
   /*NOTREACHED*/
   }
   s = -1;
   for (res = res0; res; res = res->ai_next) {
   s = socket(res->ai_family, res->ai_socktype,
   res->ai_protocol);
   if (s < 0) {
   cause = "socket";
   continue;
   }

   if (connect(s, res->ai_addr, res->ai_addrlen) < 0) {
   cause = "connect";
   close(s);
   s = -1;
   continue;
   }

   break;  /* okay we got one */
   }
   if (s < 0) {
   err(1, "%s", cause);
   /*NOTREACHED*/
   }
   freeaddrinfo(res0);

You could actually use something a little more sophisticated like

int
connect_to_host(struct addrinfo *res0) {
struct addrinfo *res;
int fd = -1, n, i, j, flags, count;
struct pollfd *fds;
int timeout = TIMEOUT;

/*
 * Work out how many possible descriptors we could use.
 */
for (res = res0, count = 0; res; res = res->ai_next)
count++;
fds = calloc(count, sizeof(*fds));
if (fds == NULL) {
perror("calloc");
goto cleanup;
}

for (res = res0, i = 0, count = 0; res; res = res->ai_next) {
fd = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
if (fd == -1) {
/*
 * If AI_ADDRCONFIG is not supported we will get
 * EAFNOSUPPORT returned.  Behave as if the address
 * was not there.
 */
if (errno != EAFNOSUPPORT)
perror("socket");
else if (res->ai_next != NULL)
continue;
} else if ((flags = fcntl(fd, F_GETFL)) == -1) {
perror("fcntl");
close(fd);
} else if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
perror("fcntl");
close(fd);
} else if (connect(fd, res->ai_addr, res->ai_addrlen) == -1) {
if (errno != EINPROGRESS) {

Re: DoD IP Space





On 2/15/21 08:25, William Herrin wrote:


Well actually, that's not entirely true. One thing holding back IPv6
is the unfortunately routine need to turn it off in order to get one
or another IPv4 thing back working again. Like the disney thing
earlier in this thread. Or like my experience yesterday where I had to
disable IPv6 to fetch files on a particular server because SLAAC was
serving up invalid addresses but the app insisted on trying all 8 IPv6
addresses before it would attempt any of the IPv4 addresses. And of
course I can't call my ISP and say: you're causing my Linux box to
pick up bad IPv6 addresses. Front line support can barely handle IPv4
and Windows.

I stuck with it for a couple hours and figured out how to disable
SLAAC without disabling DHCP-PD so that I could turn IPv6 back on with
addresses which worked. But really, how many people are going to do
that? Most tick the IPv6 checkbox to off and are done with it.

This particular problem could be quickly resolved if the OSes still
getting updates were updated to default name resolution to prioritize
the IPv4 addresses instead. That would allow broken IPv6
configurations to exist without breaking the user's entire Internet
experience. Which would allow them to leave it turned on so that it
resumes working when the error is eventually found and fixed.

Prioritizing IPv6 over IPv4 for newly initiated connections is one of
the trifecta of critical design errors that have been killing IPv6 for
two decades. One of the two that if key folks weren't being so
bull-headed about it, it would be trivial to fix.


This is not unique to IPv6. Almost every protocol (including IPv4) has 
some inherent design problem that keeps lists like this alive with 
swaths of advice and solutions.


But at its core, if money is going to stand in the way of IPv6 gaining 
global interest, the issues you, me and others face with SLAAC and other 
technical IPv6 annoyances will never receive the attention they need to 
get resolved.


Why fix something nobody wants to use in the first place?

Mark.

Re: DoD IP Space

2021-02-14 Thread William Herrin

On Sun, Feb 14, 2021 at 8:27 PM Mark Tinka  wrote:
> Dropping a few feet from cloud nine, there, really, is no other thing
> that will facilitate or hold back the adoption of IPv6, like money.

Well actually, that's not entirely true. One thing holding back IPv6
is the unfortunately routine need to turn it off in order to get one
or another IPv4 thing back working again. Like the disney thing
earlier in this thread. Or like my experience yesterday where I had to
disable IPv6 to fetch files on a particular server because SLAAC was
serving up invalid addresses but the app insisted on trying all 8 IPv6
addresses before it would attempt any of the IPv4 addresses. And of
course I can't call my ISP and say: you're causing my Linux box to
pick up bad IPv6 addresses. Front line support can barely handle IPv4
and Windows.

I stuck with it for a couple hours and figured out how to disable
SLAAC without disabling DHCP-PD so that I could turn IPv6 back on with
addresses which worked. But really, how many people are going to do
that? Most tick the IPv6 checkbox to off and are done with it.

This particular problem could be quickly resolved if the OSes still
getting updates were updated to default name resolution to prioritize
the IPv4 addresses instead. That would allow broken IPv6
configurations to exist without breaking the user's entire Internet
experience. Which would allow them to leave it turned on so that it
resumes working when the error is eventually found and fixed.

Prioritizing IPv6 over IPv4 for newly initiated connections is one of
the trifecta of critical design errors that have been killing IPv6 for
two decades. One of the two that if key folks weren't being so
bull-headed about it, it would be trivial to fix.

Regards,
Bill Herrin

--
William Herrin
b...@herrin.us
https://bill.herrin.us/

Re: DoD IP Space





On 2/14/21 22:34, Sabri Berisha wrote:


You are 100% Correct. Perhaps we can get Jeff Bezos to give 25% extra off
at the next Cyber Monday event to those accessing amazon.com via IPv6.

That will not only drive IPv6 deployment at eyeball networks, it's a
feasible plan as well. IF good ol' Jeff wants to cooperate :)


Dropping a few feet from cloud nine, there, really, is no other thing 
that will facilitate or hold back the adoption of IPv6, like money.


It will distill down into who is willing to spend it, make it or lose it.

All (other) discussions about IPv6's adoption (or lack thereof) are just 
recycled revolutions around this reality. I mean, there's a reason that 
in 2021, PS4 still does not support IPv6.


Mark.

Re: DoD IP Space

2021-02-14 Thread Sabri Berisha

- On Feb 14, 2021, at 11:56 AM, Randy Bush ra...@psg.com wrote:

Hi,

> hint: that idea is from the late '90s.  the next bright idea for what
> would help ipv6 take over the internet was 3gpp.  it's been a long line
> of things which would make ipv6 take off. 

You are 100% Correct. Perhaps we can get Jeff Bezos to give 25% extra off
at the next Cyber Monday event to those accessing amazon.com via IPv6.

That will not only drive IPv6 deployment at eyeball networks, it's a
feasible plan as well. IF good ol' Jeff wants to cooperate :)

Thanks,

Sabri

Re: DoD IP Space





On 2/14/21 21:56, Randy Bush wrote:


hint: that idea is from the late '90s.  the next bright idea for what
would help ipv6 take over the internet was 3gpp.  it's been a long line
of things which would make ipv6 take off.  and at least ten million
messages on mailing lists such as this.  and the adoption rate has
crawled up slowly; the first derivative remaining fairly flat.

of course, if you measure it at the right place, it can have steep
points.  when goog tured it up for youtube, the proportion of their v6
traffic went up nicely; no surprise.  but when i want to measure a real
rate of change, i like a mid-stream sample at some isps' borders or ixp,
away from eyeballs or eye candy.

if we all spent as much time deploying, or helping others deploy as
opposed to screaming at them that they must do it asap, we might get
that first derivative up a wee bit.  but i fear that, at this point,
patience is what is most useful.


Like I was saying to someone privately, by pr0n I really meant whatever 
app or service makes the most sense at the time. It could be gaming, it 
could be Clubhouse, it could a crossword puzzle. Something, anything. We 
know how to build online services that ordinary people see value in. 
Extending that to have it delivered mostly over IPv6 is not a huge leap, 
if all sides understood that the impetus was to promote IPv6 adoption.


But yes, short of that, patience is the only hope.

Mark.

Re: DoD IP Space

2021-02-14 Thread Randy Bush

> Perhaps it's time that we made good friends with the folk accelerating
> pr0n, and did a deal with them where someone's fetish was only
> available over IPv6.

hint: that idea is from the late '90s.  the next bright idea for what
would help ipv6 take over the internet was 3gpp.  it's been a long line
of things which would make ipv6 take off.  and at least ten million
messages on mailing lists such as this.  and the adoption rate has
crawled up slowly; the first derivative remaining fairly flat.

of course, if you measure it at the right place, it can have steep
points.  when goog tured it up for youtube, the proportion of their v6
traffic went up nicely; no surprise.  but when i want to measure a real
rate of change, i like a mid-stream sample at some isps' borders or ixp,
away from eyeballs or eye candy.

if we all spent as much time deploying, or helping others deploy as
opposed to screaming at them that they must do it asap, we might get
that first derivative up a wee bit.  but i fear that, at this point,
patience is what is most useful.

randy

Re: DoD IP Space





On 2/14/21 04:24, Mark Foster wrote:


So the business case will be the 'killer app' or perhaps 'killer service' 
that's IPv6-only and that'll provide a business reason.

But chicken and egg.. who wants to run a service that's IPv6-only and miss out 
on such a big userbase?


Perhaps it's time that we made good friends with the folk accelerating 
pr0n, and did a deal with them where someone's fetish was only available 
over IPv6. Small enough that it does not bother their existing cash cow, 
but large enough that it starts to get some notice, where eyeballs can 
put pressure on their service providers to get them access.


I'm not kidding. Because sitting back and hoping "things just happen" is 
kind of like throwing a switch into a building and putting the words 
"IXP" outside, and hoping the right people will come knocking. We know 
IXP's are obvious, but a lot of their growth comes from their operators 
running around and actually getting patronage going.


IPv6 is obvious. But I think it requires a lot more non-technical agency 
to get it adopted.


Mark.

Re: DoD IP Space