[ih] Minutes before Trump left office, millions of the Pentagon's dormant IP addresses sprang to life

[Andrew G. Malis]

Wow, according to ARIN, they are advertising a lot of space, including a /7
(two adjoining /8s in an even, odd pair):

6.132.0.0/14
6.136.0.0/13
6.144.0.0/12
6.160.0.0/11
6.192.0.0/10
7.0.0.0/8
11.0.0.0/8
21.0.0.0/8
22.0.0.0/8
26.0.0.0/8
28.0.0.0/7
30.0.0.0/8
33.0.0.0/8
136.188.0.0/14
136.192.0.0/14
136.196.0.0/15
144.235.0.0/16
144.236.0.0/14
144.240.0.0/15
144.242.0.0/16
148.32.0.0/12
152.82.0.0/16
164.180.0.0/14
164.184.0.0/14
164.188.0.0/15
164.240.0.0/13
192.13.0.0/16
192.14.0.0/16
205.0.0.0/11
205.32.0.0/12
205.48.0.0/13
215.128.0.0/9

This list shows the aggregated routes, they're actually advertising 753
prefixes, perhaps for the reason Karl noted.

As noted in the Kentik blog, this adds up to 174,784,512 individual IP
addresses. That's worth well over $3B on the open market.

Cheers,
Andy


On Mon, Apr 26, 2021 at 3:09 PM Stephane Bortzmeyer via Internet-history <
internet-history at elists.isoc.org> wrote:

> On Mon, Apr 26, 2021 at 11:57:08AM -0700,
>  Karl Auerbach via Internet-history <internet-history at elists.isoc.org>
> wrote
>  a message of 35 lines which said:
>
> > If they are advertising this as a single /8 it is unlikely that they will
> > catch many folks who are camping on smaller blocks of that space because
> > route selection will tend to use the longest match prefix rather the the
> > rather short /8 prefix.
> >
> > If they really want to sweep the space to locate usurping uses they
> probably
> > need to advertise that /8 as a sequence of /24s.
>
> It's what they do (and it's much more than a single /8). Technical
> details:
>
> https://www.kentik.com/blog/the-mystery-of-as8003/
>
> Or in your favorite BGP explorer (I use https://stat.ripe.net/)
>
> --
> Internet-history mailing list
> Internet-history at elists.isoc.org
> https://elists.isoc.org/mailman/listinfo/internet-history
>