APNIC begins allocating from "1/8" as normal

ISPs can be confident allocations from the 1.0.0.0/8 IPv4 address block will be functional after an APNIC report confirmed that 95% of the address space is relatively free of unwanted traffic.

APNIC received the 1.0.0.0/8 from IANA for allocation and assignment as public unicast space in January 2010. There were concerns that unauthorized usage of the address space would cause problems for the legitimate resource holders.

However, prior to distribution of this space, APNIC’s Resource Quality Assurance procedures have determined that most addresses in this range are viable for standard usage.

A report, titled “Traffic in Network 1.0.0.0/8” by Geoff Huston and George Michaelson of APNIC Research & Development, details how certain blocks within this range do act as an “attractor” for unwanted traffic from private-use domains, mis-configured equipment, and scanning activity.

“The findings of this report are not a cause for particular concern, because every block that is allocated to APNIC from IANA is subject to the same testing, and the majority of addresses in this block are clear” said Mr Geoff Huston, Chief Scientist with APNIC.

APNIC’s Resource Quality Assurance activities attempt to minimize routability problems through several processes including communication with network operators through NOG mailing lists, training, and a series of testing procedures such as “debogon” testing in conjunction with RIPE NCC. Test routes are announced for a minimum of one month before blocks are cleared by APNIC for allocation to ISPs in its region.

“In this case we identified a small portion of polluted addresses that will not be distributed to ISPs, but the other 95% of the address are fine to allocate,” explained Mr Huston.

Collaborating with a number of research partners, APNIC advertised the address blocks and monitored the amount of traffic received. Analysis revealed that network 1.0.0.0/8 currently attracts an average of 140Mbps - 160Mbps of incoming traffic as a continuous sustained traffic level, with peak bursts of over 800Mbps.

“The unwanted traffic is not evenly distributed,” said Mr Huston. “The majority of traffic is directed at the individual addresses 1.1.1.1 and 1.2.3.4 and the covering /24s.”

However, the report recommends withholding a larger set of addresses for further analysis in the long-term nature of unsolicited background traffic. A further 14 /16s were identified as potentially problematic and will be temporarily withheld for further analysis. A future follow-up report will make recommendations about the use of these address blocks.

“If further investigation reveals that the traffic to these addresses has returned to a normal background level, or if we find another way to make any of these network prefixes usable on the public Internet, then the addresses will be returned to the APNIC unallocated address pool,” recommended Mr Huston.

APNIC Research & Development thanks RIPE NCC, Merit, and YouTube for their generous support and collaboration on this study project and invites other collaborators interested in undertaking further research.

To view Mr Huston's full report, please see:

Traffic in Network 1 

Contact:

Phone: