How polluted is 1/8?

Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is. See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18 Please also note the call for feedback at the bottom of the article. Kind Regards, Mirjam Kuehne RIPE NCC

On Wed, Feb 03, 2010 at 04:49:00PM +0100, Mirjam Kuehne <mir@ripe.net> wrote a message of 15 lines which said:
After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is.
See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18
Not a suprise, unfortunately. See also http://bgpmon.net/blog/?p=275

It should be of no surprise to anyone that a number of the remaining prefixes are something of a mess(somebody ask t-mobile how they're using 14/8 internally for example). One's new ipv4 assignments are going to be of significantly lower quality than the one received a decade ago, The property is probably transitive in that the overall quality of the ipv4 unicast space is declining... The way to reduce the entropy in a system is to pump more energy in, there's always the question however of whether that's even worth it or not. joel Mirjam Kuehne wrote:
Hello,
After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is.
See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18
Please also note the call for feedback at the bottom of the article.
Kind Regards, Mirjam Kuehne RIPE NCC

14/8 isn't all they are using internally.. 1,4,5,42 and that's just the stuff that hasn't been delegated out by IANA yet. I am sure this practice is pervasive.. and it's an issue that doesn't typically come up in talks about prepping for IPv4 depletion. Maybe it will now.. FWIW, I don't believe these netblocks are completely unusable. If RIR policies permit you to get address space for private networks, it could be allocated to an organization that understands and accepts the pollution issue because they will never intend to route the space publicly. (Such a thing does exist..) +1 volunteering to sink traffic for 1.1.1.0/24 --heather -----Original Message----- From: Joel Jaeggli [mailto:joelja@bogus.com] Sent: Wednesday, February 03, 2010 11:09 AM To: Mirjam Kuehne Cc: nanog@nanog.org Subject: Re: How polluted is 1/8? It should be of no surprise to anyone that a number of the remaining prefixes are something of a mess(somebody ask t-mobile how they're using 14/8 internally for example). One's new ipv4 assignments are going to be of significantly lower quality than the one received a decade ago, The property is probably transitive in that the overall quality of the ipv4 unicast space is declining... The way to reduce the entropy in a system is to pump more energy in, there's always the question however of whether that's even worth it or not. joel Mirjam Kuehne wrote:
Hello,
After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is.
See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18
Please also note the call for feedback at the bottom of the article.
Kind Regards, Mirjam Kuehne RIPE NCC

Schiller, Heather A (HeatherSkanks) wrote:
14/8 isn't all they are using internally.. 1,4,5,42 and that's just the stuff that hasn't been delegated out by IANA yet.
I am sure this practice is pervasive.. and it's an issue that doesn't typically come up in talks about prepping for IPv4 depletion. Maybe it will now..
FWIW, I don't believe these netblocks are completely unusable.
Nor do I, people will receive assignments out of them, and route them and cope with the occasional blackhole. Those whose applications or internal numbering schemes use them will bear a not insignificant cost associated with mitigation.
If RIR policies permit you to get address space for private networks, it could be allocated to an organization that understands and accepts the pollution issue because they will never intend to route the space publicly. (Such a thing does exist..)
+1 volunteering to sink traffic for 1.1.1.0/24
--heather
-----Original Message----- From: Joel Jaeggli [mailto:joelja@bogus.com] Sent: Wednesday, February 03, 2010 11:09 AM To: Mirjam Kuehne Cc: nanog@nanog.org Subject: Re: How polluted is 1/8?
It should be of no surprise to anyone that a number of the remaining prefixes are something of a mess(somebody ask t-mobile how they're using 14/8 internally for example). One's new ipv4 assignments are going to be of significantly lower quality than the one received a decade ago, The property is probably transitive in that the overall quality of the ipv4 unicast space is declining...
The way to reduce the entropy in a system is to pump more energy in, there's always the question however of whether that's even worth it or not.
joel
Mirjam Kuehne wrote:
Hello,
After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is.
See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18
Please also note the call for feedback at the bottom of the article.
Kind Regards, Mirjam Kuehne RIPE NCC

In a message written on Wed, Feb 03, 2010 at 04:49:00PM +0100, Mirjam Kuehne wrote:
After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is.
Having this data is useful, but I can't help to think it would be more useful if it were compared with 27/8, or other networks. Is this slightly worse, or significantly worse than other networks? -- Leo Bicknell - bicknell@ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/

Mirjam Kuehne wrote:
Hello,
After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is.
See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18
Please also note the call for feedback at the bottom of the article.
The most surprising thing in that report was that someone has an AMS-IX port at just 10 megs. It would be nice to see an actual measurement of the traffic and daily/weekly changes. A breakdown of the flow data by source ASN and source prefix (for the top 50-100 sources) would also be interesting. - Kevin

On Feb 4, 2010, at 1:27 PM, Kevin Loch wrote:
Mirjam Kuehne wrote:
Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is. See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18 Please also note the call for feedback at the bottom of the article.
The most surprising thing in that report was that someone has an AMS-IX port at just 10 megs. It would be nice to see an actual measurement of the traffic and daily/weekly changes. A breakdown of the flow data by source ASN and source prefix (for the top 50-100 sources) would also be interesting.
There was a call on the apnic list for someone to sink some of the traffic. I'd like to see someone capture the data and post pcaps/netflow analysis, and possibly just run a http server on that /24 so people can test if their network is broken. I've taken a peek at the traffic, and I don't think it's 100's of megs, but without a global view who knows. - Jared

I know someone who'd happily sink both the /24's in question.. if apnic's interested. On Thu, Feb 4, 2010 at 2:30 PM, Jared Mauch <jared@puck.nether.net> wrote:
On Feb 4, 2010, at 1:27 PM, Kevin Loch wrote:
Mirjam Kuehne wrote:
Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is. See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18 Please also note the call for feedback at the bottom of the article.
The most surprising thing in that report was that someone has an AMS-IX port at just 10 megs. It would be nice to see an actual measurement of the traffic and daily/weekly changes. A breakdown of the flow data by source ASN and source prefix (for the top 50-100 sources) would also be interesting.
There was a call on the apnic list for someone to sink some of the traffic.
I'd like to see someone capture the data and post pcaps/netflow analysis, and possibly just run a http server on that /24 so people can test if their network is broken.
I've taken a peek at the traffic, and I don't think it's 100's of megs, but without a global view who knows.
- Jared

On Feb 4, 2010, at 3:14 PM, Christopher Morrow wrote:
I know someone who'd happily sink both the /24's in question.. if apnic's interested.
Given that it is not in the table today, just announcing it would yield both interesting traffic, and interesting data on who is filtering it. -- TTFN, patrick
On Thu, Feb 4, 2010 at 2:30 PM, Jared Mauch <jared@puck.nether.net> wrote:
On Feb 4, 2010, at 1:27 PM, Kevin Loch wrote:
Mirjam Kuehne wrote:
Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is. See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18 Please also note the call for feedback at the bottom of the article.
The most surprising thing in that report was that someone has an AMS-IX port at just 10 megs. It would be nice to see an actual measurement of the traffic and daily/weekly changes. A breakdown of the flow data by source ASN and source prefix (for the top 50-100 sources) would also be interesting.
There was a call on the apnic list for someone to sink some of the traffic.
I'd like to see someone capture the data and post pcaps/netflow analysis, and possibly just run a http server on that /24 so people can test if their network is broken.
I've taken a peek at the traffic, and I don't think it's 100's of megs, but without a global view who knows.
- Jared

On 2/4/10 2:14 PM, Christopher Morrow wrote:
I know someone who'd happily sink both the /24's in question.. if apnic's interested.
Ditto.
On Thu, Feb 4, 2010 at 2:30 PM, Jared Mauch<jared@puck.nether.net> wrote:
On Feb 4, 2010, at 1:27 PM, Kevin Loch wrote:
Mirjam Kuehne wrote:
Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some
measurements to find out how "polluted" this block really is.
See some surprising results on RIPE Labs:
Please also note the call for feedback at the bottom of the article.
The most surprising thing in that report was that someone has an AMS-IX port at just 10 megs. It would be nice to see an actual measurement of the traffic and daily/weekly changes. A breakdown of the flow data by source ASN and source prefix (for the top 50-100 sources) would also be interesting.
There was a call on the apnic list for someone to sink some of the traffic.
I'd like to see someone capture the data and post pcaps/netflow analysis, and possibly just run a http server on that /24 so people can test if their network is broken.
I've taken a peek at the traffic, and I don't think it's 100's of megs, but without a global view who knows.
- Jared

If it's not obvious, I've thoguht about this and made some offers to the people at APNIC/RIPE. Hoping someone moves forward with this. The note was on the apops list (iirc). - jared On Feb 4, 2010, at 3:18 PM, Tico wrote:
On 2/4/10 2:14 PM, Christopher Morrow wrote:
I know someone who'd happily sink both the /24's in question.. if apnic's interested.
Ditto.
On Thu, Feb 4, 2010 at 2:30 PM, Jared Mauch<jared@puck.nether.net> wrote:
On Feb 4, 2010, at 1:27 PM, Kevin Loch wrote:
Mirjam Kuehne wrote:
Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some
measurements to find out how "polluted" this block really is.
See some surprising results on RIPE Labs:
Please also note the call for feedback at the bottom of the article.
The most surprising thing in that report was that someone has an AMS-IX port at just 10 megs. It would be nice to see an actual measurement of the traffic and daily/weekly changes. A breakdown of the flow data by source ASN and source prefix (for the top 50-100 sources) would also be interesting.
There was a call on the apnic list for someone to sink some of the traffic.
I'd like to see someone capture the data and post pcaps/netflow analysis, and possibly just run a http server on that /24 so people can test if their network is broken.
I've taken a peek at the traffic, and I don't think it's 100's of megs, but without a global view who knows.
- Jared

Hi, We would also be happy to sink the traffic and provide captures and statistics for general consumption. Pete On Feb 4, 2010, at 9:30 PM, Jared Mauch wrote:
On Feb 4, 2010, at 1:27 PM, Kevin Loch wrote:
Mirjam Kuehne wrote:
Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is. See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18 Please also note the call for feedback at the bottom of the article.
The most surprising thing in that report was that someone has an AMS-IX port at just 10 megs. It would be nice to see an actual measurement of the traffic and daily/weekly changes. A breakdown of the flow data by source ASN and source prefix (for the top 50-100 sources) would also be interesting.
There was a call on the apnic list for someone to sink some of the traffic.
I'd like to see someone capture the data and post pcaps/netflow analysis, and possibly just run a http server on that /24 so people can test if their network is broken.
I've taken a peek at the traffic, and I don't think it's 100's of megs, but without a global view who knows.
- Jared
participants (11)
-
Christopher Morrow
-
Jared Mauch
-
Joel Jaeggli
-
Kevin Loch
-
Leo Bicknell
-
Mirjam Kuehne
-
Patrick W. Gilmore
-
Petri Helenius
-
Schiller, Heather A (HeatherSkanks)
-
Stephane Bortzmeyer
-
Tico