Hacker News Reader

Comment by mike_d | Hacker News Reader

.0 and .255 are special.

Even outside of the context of a /24 I still reserve these addresses because they don't receive equal treatment on the internet. There are still dumb firewalls that treat them as broadcast amplification attacks, OS bugs that treat them as invalid, and a handful of other issues.

This issue tends to be a bell curve of experience. People brand new to networking, and the people who have spent dozens of years seeing the worst of what the internet has to offer both treat them as sacred cows, with the majority just shrugging and mumbling about CIDR.

View on HN

The problem is a real problem because people have learned about the fake problem and written real bugs and created the real problem.

It is the bug that creates itself.

Wait till you see how people react to /31 and /31 ending with .0

> and the people who have spent dozens of years seeing the worst of what the internet has to offer both treat them as sacred cows

...a lot of them just didn't update their knowledge over time.

His point is that there's a pretty common journey:

- Newbies see .0 and .255 as special

- We learn about CIDR, and there's nothing special about a .0 in the middle of a large block.

- Then we get zapped by weird connectivity problems or tools that don't let us enter the address because it fails "validation," etc.

Then we think... does our DHCP range really need to cross the boundary when we have a /23? Maybe we should just have two DHCP ranges with a little hole in the middle. It's less than 1% of addresses...

The Busybox DHCP server had a special case where it wouldn't ever give out a .0 address, and I submitted a patch to remove that. I didn't even think about the possibility that someone might intentionally want that (to work around misbehavior of other devices). I don't think the person who added it was thinking that way, but I might be wrong.

The behavior of arbitrarily rejecting .0 has gotten a lot rarer in the wild lately. (I can confirm that because I've done a whole bunch of connectivity tests to .0 addresses, including using RIPE Atlas.)

It was probably added during the development of firmware for some cheap switch whose hardware did some unrecoverable nonsense when seeing such addresses in packets.

In addition to various problems with UI/validation... a whole lot of networks/devices filtered 0.0.0.0 netmask 0.0.0.255 when ICMP amplification attacks were such a thing (and before we had better mitigations).

Not likely a cheap switch. Cheap switches don't even look at IP; they just do ethernet and that's enough.

More likely to be a slightly fancy switch, or terrible CPE for DSL/Cable.

It's the complete opposite:

Experienced engineers understood that .0 and .255 are actually handled differently in the real-world, so they make sure to avoid them.

"Reality sucks, deal with it"

Newbies who just read the specs and learnt from classrooms are tricked into believing that .0 and .255 are the same. Which is true on paper, but not true in reality.

I think what you're saying is absolutely consistent with what I'm saying-- so I'm not sure what you're trying to say or if you've grokked my point (that people completely new to networking with less formal learning and people with tons of experience are superstitious about .0).

Part of that is /31 being an extension to IP that isn't universally accepted/implemented.

I tend to run /30 as the smallest because of that (no sudden surprises if a piece of gear doesn't support the extension)

"RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links" was published in December of 2000. Most systems have supported it for a long time, with Netgear (swearing under my breath) being the biggest outlier and straggler.

_cries in mikrotik_

Mikrotiks will let you use any two IPs on an interface. "ip address add interface=ether1 address=10.0.0.0 network-10.0.0.1 for example, but you could also use address=10.0.0.0 network=192.168.0.0.

I think last time I used it there were a few bugs around redistribution. I tend to use private IPs, certainly for p2ps, so a /30 is fine

It was already mentioned but Mikrotik allows /31 just fine

Worked at a large website holster and we didn't treat these addresses differently. Didn't hear anything from customers while I worked here. Maybe it depends of the country (and their majority vendors)

You're completely ignoring the point that the parent was making.

This whole post is about quantifying exactly how different the treatment of .0 is to other addresses. The answer is: not much.

4% failure is much?

I don't agree, especially if those 4% are systems you disproportionately don't care about.

If you think about it in terms of many gigabit/s but also in terms of causing "intermittent" application issues I would say it isn't something that can be considered negligible. .04% sure but 4% is noticable imho. When I was working in networking, I've had a couple of problems I resolved in the lines of "we have 10% packet loss but only to this specific site" which took non-negligible man-hours to resolve. It is significant enough for some sensitive customers (especially gaming servers and such) to require support on it.

I'd say .1 is a bit special too (even more for FHRPs), and there are weirdos who use .254 for their gateways. I've even seen a lunatic or two put it somewhere in the middle of the subnet.

Blindly assuming .1 is your router is a bad idea. I've seen cases when it all started with a single uber-host at .1 which does routing, DNS, DHCP, mail, and internal web server; and later on the routing part was moved to a separate device with its own IP.

Also, well-known IPs, and 192.168.0.1 in particular, should just be avoided. You don't want IP conflict in your network just because someone plugged in unconfigure device!

I've had several ISP routers come with .254 as the default IP, this that's the gateway.

Huh. I typically do middle of the subnet. Static addresses below it and dynamic addresses above it. I think it's how the first datacenter I worked at back in the Pleistocene did it and I just kept the habit.

FWIW I avoid .1 and .254 as they are too common. If some router-specific malware is going to try target the most common denominator, it'd be these.

Reply on news.ycombinator.com