Does this mean?
Designed to ensure classification attempts by Trump could by widely known.
Good Hunting... from Varmint Al
Posted on 04/24/2021 7:32:22 PM PDT by narses
On January 20, 2021, a great mystery appeared in the internet’s global routing table. An entity that hadn’t been heard from in over a decade began announcing large swaths of formerly unused IPv4 address space belonging to the U.S. Department of Defense. Registered as GRS-DoD, AS8003 began announcing 11.0.0.0/8 among other large DoD IPv4 ranges.
According to data available from University of Oregon’s Routeviews project, one of the very first BGP messages from AS8003 to the internet was:
TIME: 01/20/21 16:57:35 TYPE: BGP4MP/MESSAGE/Update FROM: 62.115.128.183 AS1299 TO: 128.223.51.15 AS6447 ORIGIN: IGP ASPATH: 1299 6939 6939 8003 NEXT_HOP: 62.115.128.183 ANNOUNCE 11.0.0.0/8 The message above has a timestamp of 16:57 UTC (11:57am ET) on January 20, 2021, moments after the swearing in of Joe Biden as the President of the United States and minutes before the statutory end of the administration of Donald Trump at noon Eastern time.
The questions that started to surface included: Who is AS8003? Why are they announcing huge amounts of IPv4 space belonging to the U.S. Department of Defense? And perhaps most interestingly, why did it come alive within the final three minutes of the Trump administration?
By late January, AS8003 was announcing about 56 million IPv4 addresses, making it the sixth largest AS in the IPv4 global routing table by originated address space. By mid-April, AS8003 dramatically increased the amount of formerly unused DoD address space that it announced to 175 million unique addresses.
Following the increase, AS8003 became, far and away, the largest AS in the history of the internet as measured by originated IPv4 space. By comparison, AS8003 now announces 61 million more IP addresses than the now-second biggest AS in the world, China Telecom, and over 100 million more addresses than Comcast, the largest residential internet provider in the U.S.
In fact, as of April 20, 2021, AS8003 is announcing so much IPv4 space that 5.7% of the entire IPv4 global routing table is presently originated by AS8003. In other words, more than one out of every 20 IPv4 addresses is presently originated by an entity that didn’t even appear in the routing table at the beginning of the year.
A valuable asset
Decades ago, the U.S. Department of Defense was allocated numerous massive ranges of IPv4 address space - after all, the internet was conceived as a Defense Dept project. Over the years, only a portion of that address space was ever utilized (i.e. announced by the DoD on the internet). As the internet grew, the pool of available IPv4 dwindled until a private market emerged to facilitate the sale of what was no longer just a simple router setting, but an increasingly precious commodity.
Even as other nations began purchasing IPv4 as a strategic investment, the DoD sat on much of their unused supply of address space. In 2019, Members of Congress attempted to force the sale of all of the DoD’s IPv4 address space by proposing the following provision be added to the National Defense Authorization Act for 2020:
Sale of Internet Protocol Addresses. Section 1088 would require the Secretary of Defense to sell at fair market value all of the department’s Internet Protocol version 4 (IPv4) addresses over the next 10 years. The proceeds from those sales, after paying for sales transaction costs, would be deposited in the General Fund of the Treasury.
The authors of the proposed legislation used a Congressional Budget Office estimate that a /8 (16.7 million addresses) would fetch $100 million after transaction fees. In the end, it didn’t matter because this provision was stripped from the final bill that was signed into law - the Department of Defense would be funded in 2020 without having to sell this precious internet resource.
What is AS8003 doing?
Last month, astute contributors to the NANOG listserv highlighted the oddity of massive amounts of DoD address space being announced by what appeared to be a shell company. While a BGP hijack was ruled out, the exact purpose was still unclear. Until yesterday when the Department of Defense provided an explanation to reporters from the Washington Post about this unusual internet development. Their statement said:
Defense Digital Service (DDS) authorized a pilot effort advertising DoD Internet Protocol (IP) space using Border Gateway Protocol (BGP). This pilot will assess, evaluate and prevent unauthorized use of DoD IP address space. Additionally, this pilot may identify potential vulnerabilities. This is one of DoD’s many efforts focused on continually improving our cyber posture and defense in response to advanced persistent threats. We are partnering throughout DoD to ensure potential vulnerabilities are mitigated.
I interpret this to mean that the objectives of this effort are twofold. First, to announce this address space to scare off any would-be squatters, and secondly, to collect a massive amount of background internet traffic for threat intelligence.
On the first point, there is a vast world of fraudulent BGP routing out there. As I’ve documented over the years, various types of bad actors use unrouted address space to bypass blocklists in order to send spam and other types of malicious traffic.
On the second, there is a lot of background noise that can be scooped up when announcing large ranges of IPv4 address space. A recent example is Cloudflare’s announcement of 1.1.1.0/24 and 1.0.0.0/24 in 2018.
For decades, internet routing operated with a widespread assumption that ASes didn’t route these prefixes on the internet (perhaps because they were canonical examples from networking textbooks). According to their blog post soon after the launch, Cloudflare received “~10Gbps of unsolicited background traffic” on their interfaces.
And that was just for 512 IPv4 addresses! Of course, those addresses were very special, but it stands to reason that 175 million IPv4 addresses will attract orders of magnitude more traffic. More misconfigured devices and networks that mistakenly assumed that all of this DoD address space would never see the light of day.
Conclusion
While today’s statement from the DoD answers some questions, much remains a mystery. Why did the DoD not just announce this address space themselves instead of directing an outside entity to use the AS of a long dormant email marketing firm? Why did it come to life in the final moments of the previous administration?
We likely won’t get all of the answers anytime soon, but we can certainly hope that the DoD uses the threat intel gleaned from the large amounts of background traffic for the benefit of everyone. Maybe they could come to a NANOG conference and present about the troves of erroneous traffic being sent their way.
A link? How are the two connected?
Anyone?
Good Hunting... from Varmint Al
Maybe.
I’ve only got a background in some early computerese, but I’ll give it a shot (and I’m NOT sure I even have a good handle on this).
Sounds like the DOD manages the “lookup message routing table” for lack of the appropriate term. Everyone’s computer, router, and other internet connected device (phones, washing machines, apparently some voting machines [/s]) have a unique address, similar in the way everyone’s house has a unique address (one of Free Republics is 45.79.XX.181 for example). If you go to your CMD line (Start->Command Prompt) and type “tracert www.freerepublic.com”, you can see all the bounces (servers) your command requests/return web pages to FR go through to reach the web page files at FR.
As far as why the DOD expanded this significantly just as Trump left office, I can only speculate. But just like Bill Gates supposedly saying way back when “Oh, I would think 640kb of RAM should be enough” when asked about the limits on computer memory, well, there’s a lot of expansion that needs to happen. Maybe they’re doing it for something related to the 2020 election, or just doing it for all the autonomous vehicles of the future, who knows. Hope this helps without all the acronymania. And yes, I just came up with that word... < :-) >
I don’t understand it either. But I do know we don’t need to worry about this.
If there are 4 billion PUBLIC Internet addresses, that’s certainly sufficient.
The reason being that one internet address can explode below it into a gazillion PRIVATE addresses below it.
And the internet is slowly moving toward IPv6 that will vastly increase the amount of PUBLIC internet space.
I’m now working on a paper for a company who is trying to enable a vastly more secure and better functioning Internet by enabling the users themselves (companies and individuals) to route their traffic with more control — and away from the control of large internet companies (Comcast, AT&T, etc.)
And this will somewhat counter the aim of politicians like Xiden to control us. However, for security reasons, the government will have a back door “lawful intercept” to catch criminals. But not necessarily stop criminals in our government who operate election machines :-(
All this means is the US is releasing or ‘offering for public sale and use’ a large block of IP addresses. DARPA invented the internet and all IP spaces were originated on US equipment. Anyone who wanted in needed to obtain a block of IPs from the originator who had them. IPs need to be official so they are registered, listed and routable globally.
Possibly people were using these IP addresses surreptitiously and they were creeping into global route tables. Publishing them and offering them for sale is a good way to clean up routes and provide the additional IPs the global marketplace can use. Now that they’re out in the open they’ll be purchased, published and used. This will clean up some bad routing issues allowing traffic to run more efficiently.
Of course it could all be something more nefarious or even sinister.
But imo this could be a good boost for SpaceX’s StarLink internet service if they purchase the addresses. It’ll greatly improve their customers’ service by reducing the number of routers needed to deliver to end users. Good streamlining.
Thank you.
Your explaination explains everything
TY, PP
Thanks FReepers!
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.