Hacker News Reader

But the point is that they're not using it. If it's not addressable from the internet, why not use 10.0.0.0/8 instead?

For some applications, it's valuable to have globally-unique addresses even if they're not (all) broadly accessible from the open Internet. For example, if you're building private links between networks which don't share an authority for distributing private network addresses (they're administered by different companies or organizations perhaps). I don't know how common this is anymore, but I've seen it in the past.

> For some applications, it's valuable to have globally-unique addresses even if they're not (all) broadly accessible from the open Internet.

For a real-life example of that: according to documentation which can be found at its website, the Brazilian Central Bank has been allocated a full /18 for the national inter-bank network; each financial institution connected to that network receives a /27 or a /28 (or a pair of them) from that range. If you look up that address range on bgp.he.net, you'll find out that it's not announced to the public Internet at all.

There's a case for these, but it's not as broad as needing 16 million publicly usable IPs for IBM alone.

It's not relevant whether or not it's accessible from the internet.

And that 9/8 allocation predates RFC1918 by at least four years.

I'm curious what you mean by this. RFC1918 is just an update for earlier RFCs that go back farther in time, like RFC1597. And IBM people are credited on the relevant RFCs.

IBM is basically hoarding a bunch of addresses where there's no technical reason to. I get that they aren't required to do anything about it, but it does seem topically relevant.

IBM owns Softlayer. They may have a legitimate need for that many addresses. :)

Why 10.0.0.0/8 is as it is now and why IBM used to be 9.0.0.0/8 in the first place?

Before classless addressing, RFC1918 set out a reserved IP space in each class. 10.0.0.0/8 was set aside in the class A range by ARIN.

You might want to allow specific machines to be addressable from the internet. Also, NATs were buggy back then and many pieces of software simply wouldn't work unless you had a real IP address. VLANs and other advanced router features didn't really exist, either.

Here's a little different approach to the issue: because IBM is using IP addresses the way they were intended. Private IP ranges are not a good thing, they are a necessary evil.

NAT was developed as essentially a hack, originally more to solve tricky routing situations, but later more to allow broad use of reserved range IPs. But the original intent was always that all hosts would have a unique address, regardless of where they were or were not reachable form (or advertised to). This is a significantly better situation than the modern world of widespread use of reserved ranges and NAT, because it meant that there would not be addressing conflicts even between two private networks. Or, more practically, it meant that setting up tunneled connectivity (VPN, MPLS, whatever) between networks not advertised to the public internet always works properly, because those networks are using IP addressing as intended and thus can simply advertise their routes to each other.

Private IP ranges for "private" hosts are an adaptation to the limitations of IPv4 space, not any kind of design ideal. It's an awkward solution to a bad problem that makes numerous real-world IT situations more difficult, most commonly the case of setting up VPNs between private networks and being forced to introduce NAT because they are both using overlapping private IP space.

A very common but small example of this is the need to choose "unusual" private IP prefixes for VPN networks (like 10.106.41.0/24 or something else sort of randomly selected), because if you use something "simple" like 192.168.1.0/24 or 10.0.0.0/24 you are 100% guaranteed to run into route conflicts because of people's home and small business networks using these ranges internally. If everyone used properly allocated IPs, even on private networks, we simply wouldn't have this problem!

IPv6 offers us a bit of a reset opportunity since it was designed to have enough /64s available to allow use on private networks. Hopefully people understand this and use IPv6 the way it was intended!

You spoke of one of my most annoying issues as a VPN user. Ultimately I resolved it by myself using a non-standard private IP range at home. Any IT person that might ever use 192.168.0.0/16 space for their VPN network is an absolute masochist.

> Private IP ranges are not a good thing, they are a necessary evil.

Well, no. The word "Internet" is short for "Inter-network exchange".

The original idea of the internet was to allow LANs to talk to each other. Not to give every single device on Earth its own unique key.

> Why would that be relevant here

Because it shows how wasteful these companies operate with resources others are in need of.

It's irrelevant. Even if the authority existed to reclaim all the /8s handed out to private companies (it doesn't) you'd kick the can down the road a few years at best. Then we'd be right back in the same boat.

There are only ~4 billion IPv4 addresses. There are more than that many humans alive, most of whom have or will have a smartphone. So we're already short on addresses without considering network equipment, servers, IoT, or anything else.

If they own the IP space they can do with it as they please. They've had it since 1992.

It reminds me of the nouveau urbanists that move into places like SF in droves then instantly start complaining that the little old lady down the street, who has lived in the same house for 50 years, is being greedy and wasteful because she doesn't sell her family home to developers who will build 50 shoebox condos in its place.

I suspect most of the "10/8 ought to be enough for anyone" crowd has never worked on a complex enterprise network. Just because a netblock is in use doesn't mean it has to be routable to the Internet.

The problem isn't with IBM. The problem is all the cloud BS -- the 18,000th food delivery app that no one asked for -- isn't using IPv6. And that's just pure laziness on the developers' part.

Of a highly constrained resource, they're using a tiny fraction of what they've been given. That's a weird definition of "using what they have."

If I asked for a class C for my business running a local corner store, I'd be looked at like I was crazy.

IBM gets 16 million public IPs and it's cool?

Yeah, I know you can't perfectly use an IP space, but with 128 offices, IBM could give each office an allocation of around a hundred thousand IP addresses (rounding down by over 20%. But even if it were 10,000 - that's still absurd.)

It may be difficult to understand now, but back in the 90's, addresses were handed out like candy. IBM got their allocation in the late 80's.

I worked for a couple of small and mid-sized companies that had /16's and larger. And we barely used a fraction of that space.

I have a /24, personally, registered back in 1993. It's routed to my home network. I know several other folks who were on the early internet, and had the same.

Over at a University we run, we like to run like a ISP and only have a /16 to work with, its very tight even now, we have thousands of students using the Wifi, Dorm Networks and such. I do wish we had more.

Shouldn't many of those be on NATs?

No, ISPs shouldn't force users behind NATs.

During a shortage, push comes to shove.

> "shouldn't"s are not very useful during shortages.

There is an important difference between "it might be necessary to put them behind NATs" and "shouldn't they be on NATs?".

Hence the word "many." It's interesting because econ deniers are common at university, haha.

In any case, /16 should be enough room to prioritize.

Incorrect. ISPs should use NAT. Users should pay for their own address if they desire.

I'd rather the ISP pushed for IPv6.

We are at least at the ISP I work for. That is a major project for us this year, but any network engineer can tell you that deploying IPv6 is not straight forward at the ISP level. Getting everyone together on how to have some standard form of addressing from different entities is the toughest lift. Get Juniper, Cisco, and Arista on the phone and you will get three different ways on how to deploy it. You don't want to be the odd duck once the dust settles.

Interesting. What are the big differences if you're allowed to talk about it? I have no doubt that the IPv6 rollout is difficult, I helped move some simply cloud stuff to IPv6 and even that had a few issues. I'm much happier without the heavy layers of NAT though.

T-Mobile is actually one of the largest users of IPv6

dorms and wifi should definitely be NAT. you can always give a public address if someone specifically requests it.

Yes, and they help protect as well. The percentage of folks who even ask will be low.

Do dorms have IPv6? If students can’t run servers, where does the next generation of developers come from?

I tried running a Pi in my college dorm. First, it was NAT, and when I requested a public IP, IT said they didn't give IPs to students. :/

IPv6 would be cool.

Back the 90's, all the dorms gave students static IPs. The Internet was unfiltered, no firewalls. It was a different time.

Using only a fraction of your assigned IP address space is good and normal.

What is bad is ipv4 doesn't have enough space for everyone. Time to move onto ipv6. I don't know how to make that happen.

IBM was the original "cloud"... AKA mainframes. They had a LOT of addressed services for decades (still do).

If you want to pick on a company for hogging IPv4 space, pick on Apple. They have a /8 and probably aren't using any of it.

I'd thought apple was using its own IP space for its 'services' hosting.

Indeed, both apple.com and icloud.com resolve to 17.253.144.10

> If you want to pick on a company for hogging IPv4 space, pick on Apple. They have a /8 and probably aren't using any of it.

Most (if not all) of Apple's infrastructure uses their /8 block. With Apple Park they've moved to using a 10/8 with NAT for talking to the outside. Between iCloud, iTMS/App Store, and iMessage Apple's got a non-trivial amount of global network infrastructure beyond just their corporate network.

So I guess be mad at Apple for using their IP space?

I guess I never considered Apple a major player in cloud. I stand corrected.

> If I asked for a class C for my business running a local corner store, I'd be looked at like I was crazy.

I asked for a /22 of IPv4 for my home, and was given it, 3 years ago. I also got a /32 of IPv6, and a 32bit ASN to do BGP with.

I paid the signup fees to become an LIR, paid the membership fees, and requested my /22, /32, and ASN allocations. There were no looks, crazy or otherwise. The policies are pretty transparent. Pay money, receive resources.

That said, the policies have since changed (about a year ago?)

Everyone was talking about domain name squatting but turns out its been IP addresses this whole time :-D

But that does definitely seem like an excessive amount for them to own. I would guess the huge swathes the government has reserved are not exactly being used to their potential either.

We have run out of freely allocatable IPv4 and equipment isn't catching up to IPv6 - it's very relevant here.

Neither Apple, not IBM, actually need that many publicly useful set of IPs. IBM would be smart to sell them off. Apple is probably going to sit on them. (I used to work at IBM and that 9 block was very confusing to me, considering that IBM isn't even that big of a DC operator these days)

> equipment isn't catching up to IPv6

It's not equipment...it's purely a financial business decision that this hasn't happened yet.

The financial decision is... cost of upgrading equipment.

What should be done is charging fixed rate fee per IPv4 address. Maybe there's a problem that developed countries are too rich.

Apple is definitely still using it.