Hacker News Reader

Comment by jonawesomegreen | Hacker News Reader

I've often wondered how much of the IPv4 address space is legacy allocations that are not at all being fully utilized. Perhaps the market for IPv4 addresses has worked this out, and anyone that has such an allocation has cashed in.

View on HN

There are tons of legacy allocations from the 90's and earlier than are not being routed / utilized. Many are also assigned to defunct entities. To confirm this, you can poke around WHOIS a little bit. Because many of them actually predate ARIN's formation in 1997, they are considered "legacy" allocations and aren't charged a fee by ARIN unless the organization has opted into an agreement.

Here's one, it's under S-MOS Systems, Inc. (SMOSSY) which was bought by Epson the printer company. Somebody registered the domain when it expired and sold the company + "IPs" to a company I worked at in the Noc. When we went to ARIN to set everything up for rDNS, ARIN pushed back and said you do not own these, Epson own's this range. The company that sold the IPs disappeared with the money. The smos.com registration lapsed and some chinese company immediately registered the domain.

148.130.0.0/16

The IPs in question were directly assigned to the defendant by ARIN based on fraudulent requests. They weren't fraudulently transferred from existing allocations.

Thank you. I misread the article. I edited my post to take out the incorrect part.

For enough dollars you can sample 100k address at random and have a decent guess?

Not everyone responds to a ping but I suspect most do

ICMP is blocked by default now in many firewall setups, so unless the admin specifically allows ICMP the packets will likely be dropped.

Also, be careful as "host discovery" can be viewed as a type of "hacking" depending on who you are and who is watching/judging you.

Your first point is definitely correct.

Your second point though... really? Do you have any sources for anyone, anywhere being charged for using ping?

No, I haven't heard of anyone being criminally charged for ping, but I have known someone whose ISP cut them off and he had to go through an onerous process to get service restored. I've also heard of people that use EC2 instances and get their AWS account terminated.

AWS is also overzealous about DMCA notices. If you go to other providers like Scaleway, they'll forward any abuse complaints but you don't have to do anything about them.

Hadn't heard of Scaleway before, but their prices look very reasonable! Are you a customer of theirs? Any issues with reliability?

I don't use Scaleway or Online.net, as they're known for ignoring abuse reports. Other hosts like OVH tend to forward abuse reports and deal with repeat offenders, a good middle ground between AWS's draconian policies and Scaleway's.

With regards to the second point, definitely.

Quite a few years ago the security team of the organisation I worked at didn't have our internal vulnerability scanning services automated. It relied on them capturing the IPv4 addresses (specifically the /32's, not the subnets) and manually entering them into the engine.

Our security team mistyped a handful of these addresses and instead of the scan running across our internal infrastructure, we scanned WalMarts external facing infrastructure in the US from Australia.

These scans were happening semi-regularly for a period of a few weeks before we received a cease and desist and the sec. team realised their error. I'm still rather surprised more didn't come of it.

Scanning for known vulnerabilities isn't the same as a simple ICMP ping though.

Adding to sibling comments, some networks are extremely heavy-handed at self-regulating host discovery. Back when I was on AS88, I once got a warning alleging that I was performing suspicious port scans. I acquired a report of my “suspicious” activities from the admin, and turns out all I did was connecting to port 22 of some two dozen hosts I rented from a handful of VPS providers across North America and Europe. Of course the warning was dropped after my explanation, but I found it pretty crazy.

Thankfully there are search engines that do that for you, like shodan.

For 0 dollars, you can get a BGP table dump and see how many addresses aren't even routable. (doesn't mean they're not in use, but makes it less likely)

Reply on news.ycombinator.com