Hacker News Reader

Comment by iscoelho | Hacker News Reader

This is not a correct assumption.

1. RFC1918 space is not "filtered". It is unroutable, because no route exists on the internet.

1a. Effectively, this is the same result, however it is still an important distinction to note: telecom networks rarely ACL or "filter" transit traffic without a) an associated service offering (like DDoS Mitigation) b) a customer request or c) RPF.

1b. Telecom networks do however filter transit routes. RFC1918 routes would be filtered on internet BGP sessions.

2. It is infrequent that RFC1918 space is used internally in telecom networks. It does happen, but it is rare.

View on HN

> 2. It is infrequent that RFC1918 space is used internally in telecom networks. It does happen, but it is rare.

I have worked at 2 different ISPs... RFC1918 is used EVERYWHERE, including on networks that customers can reach by sending packets through their modems/CPE. I am also familiar with the internal network of 3 others because we closely worked together during a bunch of merger/acquisitions/divestments/territory split-ups.

This caused a lot of fun when one customer ran nmap across all of RFC1918 space and hit internal security systems that were advertised across the ISPs backbone but were not properly filtered for traffic coming from customers because of a bug in a CMTS that failed to properly apply ACL's.

A lot of telecoms avoid it like the plague because: 1. it destroys network observability 2. they have so much IP space they don't even know what to do with it. /30 everything!

Management networks are a different story, but hey, some Tier 1's think they're so large they don't even need OOB anymore! (haha...)

RFC1918 space is perfectly routable, and it is routed all the time.

The fact that is is not routed throughout Internet is another thing.

It's implied in my message that I'm referring to the internet: "It is unroutable, because no route exists on the internet."

Reply on news.ycombinator.com