RE: Unassigned Networks List

RE: Unassigned Networks List

[George J. Jahchan, Eng.]

Pavan,
I am trying to block RFC1918 networks, in addition to unassigned ones (IANA
reserved or not assigned) from getting in or out on the public interface.
Any traffic coming in (or leaving) from such networks on the public
interface undoubtedly has a spoofed source IP and should be dropped.
As mentioned before, classes A & D networks are fairly well documented on
IANA's site <http://www.iana.org/assignments/ipv4-address-space>, but B and
C are listed as "various registries" and in bulk, which is of no help.
I need a list of 128~191 and 192~223 netblocks which are either reserved or
not assigned.
Site filtering based on content classification is an entirely different
matter that is best handled at the http proxy level, and is of no relevance
here.
Thank you for any help,
Regards,
George.
-----Original Message-----
From: 	Pavan Gokarn [mailto:pavang@techknowledge.ws]
Sent:	Wednesday, March 05, 2003 7:23 AM
To:	George J. Jahchan, Eng.
Subject:	Re: Unassigned Networks List
what do you want to do george. do u want to block some sites which are
bad(porn) or block a range of specific ip addresses. in the former case I
might me able to help you.
regards

Re: Unassigned Networks List

[Sascha Reissner]

From: "George J. Jahchan, Eng." <NetFilter-Users@Compucenter.org>

[...]

> As mentioned before, classes A & D networks are fairly well documented on
> IANA's site <http://www.iana.org/assignments/ipv4-address-space>, but B
and
> C are listed as "various registries" and in bulk, which is of no help.
> I need a list of 128~191 and 192~223 netblocks which are either reserved
or
> not assigned.

[...]

so you plan on checking currently unassigned ip blocks on a daily base just
in case some ISP suddenly gets such a block assigned?

well, there are for sure some efford/reward relations that are not worth
doing.. this is one of them ;)

if you want security, unplug the network cable ;-)

Re: Unassigned Networks List

[Daniel Wittenberg]

Just something of interest I ran into the other day with a client.  We
moved them to a new building, and setup their new wireless connection,
and for the life of me couldn't ping their provider, but everyone else. 
It seems their provider is using 172 and 10.x addresses for their
wireless towers, and gateways to the internet.  So if I traceroute to
the client I get public -> public -> private -> private -> private ->
public.  It didn't work going out from the client at first because we
drop all reserved addresses on the public NIC of the firewall, so we
couldn't ping the provider.  I subsequently got in an "discussion" with
their CTO about RFC 1918 on how it's probably not good to be using
private IP's to route public traffic, at least IMHO.

Dan

On Sat, 2003-03-08 at 00:39, Sascha Reissner wrote:
> From: "George J. Jahchan, Eng." <NetFilter-Users@Compucenter.org>
> 
> [...]
> 
> > As mentioned before, classes A & D networks are fairly well documented on
> > IANA's site <http://www.iana.org/assignments/ipv4-address-space>, but B
> and
> > C are listed as "various registries" and in bulk, which is of no help.
> > I need a list of 128~191 and 192~223 netblocks which are either reserved
> or
> > not assigned.
> 
> [...]
> 
> so you plan on checking currently unassigned ip blocks on a daily base just
> in case some ISP suddenly gets such a block assigned?
> 
> well, there are for sure some efford/reward relations that are not worth
> doing.. this is one of them ;)
> 
> if you want security, unplug the network cable ;-)
> 

Re: Unassigned Networks List

[Arnt Karlsen]

On 08 Mar 2003 00:48:47 -0600, 
Daniel Wittenberg <daniel-wittenberg@starken.com> wrote in message 
<1047106127.2050.56.camel@runabout.noc.starken.com>:

> Just something of interest I ran into the other day with a client.  We
> moved them to a new building, and setup their new wireless connection,
> and for the life of me couldn't ping their provider, but everyone
> else. It seems their provider is using 172 and 10.x addresses for
> their wireless towers, and gateways to the internet.  So if I
> traceroute to the client I get public -> public -> private -> private
> -> private -> public.  It didn't work going out from the client at
> first because we drop all reserved addresses on the public NIC of the
> firewall, so we couldn't ping the provider.  I subsequently got in an
> "discussion" with their CTO about RFC 1918 on how it's probably not
> good to be using private IP's to route public traffic, at least IMHO.

..such discussions are better taken in public, so the hotshot can
show off his alledged competence...  ;-)

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Re: Unassigned Networks List

[Kelly Setzer]

On Sat, Mar 08, 2003 at 01:03:50PM +0100, Arnt Karlsen wrote:
> On 08 Mar 2003 00:48:47 -0600, 
> Daniel Wittenberg <daniel-wittenberg@starken.com> wrote in message 
> <1047106127.2050.56.camel@runabout.noc.starken.com>:
> 
> > firewall, so we couldn't ping the provider.  I subsequently got in an
> > "discussion" with their CTO about RFC 1918 on how it's probably not
> > good to be using private IP's to route public traffic, at least IMHO.
> 
> ..such discussions are better taken in public, so the hotshot can
> show off his alledged competence...  ;-)

When @home was just getting off the ground, they used to expose 10/8
addresses.  I was talking to a first or second level network engineer,
and he *INSISTED* that 10/8 has been assigned to @home.

ha

Kelly

Re: Unassigned Networks List

[Arnt Karlsen]

On Sat, 8 Mar 2003 08:07:03 -0600, 
Kelly Setzer <Kelly.Setzer@placemark.com> wrote in message 
<20030308140703.GB2652@placemark.com>:

> On Sat, Mar 08, 2003 at 01:03:50PM +0100, Arnt Karlsen wrote:
> > On 08 Mar 2003 00:48:47 -0600, 
> > Daniel Wittenberg <daniel-wittenberg@starken.com> wrote in message 
> > <1047106127.2050.56.camel@runabout.noc.starken.com>:
> > 
> > > firewall, so we couldn't ping the provider.  I subsequently got in
> > > an"discussion" with their CTO about RFC 1918 on how it's probably
> > > not good to be using private IP's to route public traffic, at
> > > least IMHO.
> > 
> > ..such discussions are better taken in public, so the hotshot can
> > show off his alledged competence...  ;-)
> 
> When @home was just getting off the ground, they used to expose 10/8
> addresses.  I was talking to a first or second level network engineer,
> and he *INSISTED* that 10/8 has been assigned to @home.
> 
> ha

..but he is _right_, even I use it here at _my_ home,  
and, I even have 192.168/16 and 172.16/12.  ;-)

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Re: Unassigned Networks List

[nbastin]

On Saturday, March 8, 2003, at 12:51 AM, George J. Jahchan, Eng. wrote:

> Pavan,
> I am trying to block RFC1918 networks, in addition to unassigned ones 
> (IANA
> reserved or not assigned) from getting in or out on the public 
> interface.
> Any traffic coming in (or leaving) from such networks on the public
> interface undoubtedly has a spoofed source IP and should be dropped.
> As mentioned before, classes A & D networks are fairly well documented 
> on
> IANA's site <http://www.iana.org/assignments/ipv4-address-space>, but 
> B and
> C are listed as "various registries" and in bulk, which is of no help.
> I need a list of 128~191 and 192~223 netblocks which are either 
> reserved or
> not assigned.

Those blocks are assigned, not reserved, and are in use, so why do you 
care that it might be assigned to various registries?  It's marked as 
various registries because the blocks were handed out before the 
current allocation policy was in place, and various pieces of those 
blocks were given to disparate registries and users.

In any event, the IANA recently reclaimed a lot of that space and the 
new list on their web site has about 20 /8's marked as reserved, 
instead of 'various registries'.

--
Nick

RE: Unassigned Networks List

[Jason Opperisano]

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Looks like I'm a little slow with this, but just came across it
(again) and remembered you had asked (somewhat recently)...

http://www.cymru.com/Documents/bogon-list.html

HTH.

- -j

- -----Original Message-----
From: George J. Jahchan, Eng.
[mailto:NetFilter-Users@Compucenter.org] 
Sent: Tuesday, March 04, 2003 10:17 PM
To: Netfilter
Subject: Unassigned Networks List


I need to ingress/egress filter unassigned netblocks and I am having
a very
hard time finding a comprehensive list of unassigned class B and C
networks.
It is extremely time consuming to go through the different regional
registrars to come up with such a list, not to mention putting
networks back
together to minimize the number of rules.
IANA has good class A and D lists, B and C classes are however listed
"in
bulk" (next to useless). Searching through Google I came up empty
handed.
Does anyone have a comprehensive list they are willing to share, or
links to
sites that list these network blocks.
TIA


-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4

iQA/AwUBPm+l46nGvB5QXYGaEQJGIACfR1rQmNz2OBPYjOyZAVRpYb/uqJgAn2Nk
qjIaPl4KtRmr77njrvkwrZDI
=K9cD
-----END PGP SIGNATURE-----

Unassigned Networks List

[George J. Jahchan, Eng.]

I need to ingress/egress filter unassigned netblocks and I am having a very
hard time finding a comprehensive list of unassigned class B and C networks.
It is extremely time consuming to go through the different regional
registrars to come up with such a list, not to mention putting networks back
together to minimize the number of rules.
IANA has good class A and D lists, B and C classes are however listed "in
bulk" (next to useless). Searching through Google I came up empty handed.
Does anyone have a comprehensive list they are willing to share, or links to
sites that list these network blocks.
TIA

RE: Unassigned Networks List

[Jeremy Jones]

This should help:

http://www.iana.org/assignments/ipv4-address-space

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of George J.
Jahchan, Eng.
Sent: Tuesday, March 04, 2003 8:17 PM
To: Netfilter
Subject: Unassigned Networks List


I need to ingress/egress filter unassigned netblocks and I am having a very
hard time finding a comprehensive list of unassigned class B and C networks.
It is extremely time consuming to go through the different regional
registrars to come up with such a list, not to mention putting networks back
together to minimize the number of rules.
IANA has good class A and D lists, B and C classes are however listed "in
bulk" (next to useless). Searching through Google I came up empty handed.
Does anyone have a comprehensive list they are willing to share, or links to
sites that list these network blocks.
TIA