Did AS8003 just disappear?

https://www.kentik.com/blog/wait-did-as8003-just-disappear/

by Aaronn • 5 years ago

153 72 5 years ago

Once again as a final note: your corporate network may be using the formerly unused DoD space internally, and if so, there is a risk you could be leaking it out to a party that is actively collecting it. How could you know? Using Kentik’s Data Explorer, you could quickly and easily view the stats of exactly how much data you’re leaking to AS8003 (now AS749). May be worth a check, and if so, start a free trial of Kentik to do so.

Not that I don't appreciate the free trial offer. But before getting into data characteristics, I'm curious which addresses should be examined in a cursory internal look-see?

0x0000000• 5 years ago

11.0.0.0/8

themodelplumber2• 5 years ago

Thank you

bogomipz• 5 years ago

Was it ever common to use 11/8 internally? Did people just roll dice because it wasn't being announced? The reference in the post is the first I've heard of people possibly using it.

Lammy• 5 years ago

https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

zamadatix• 5 years ago

If you're going to look for one such risk you might as well look for them all - if it's public space and you don't own it you should get off it regardless what isn't advertised on the internet today.

baxtr• 5 years ago

The message above has a timestamp of 16:57 UTC (11:57am ET) on January 20, 2021, moments after the swearing in of Joe Biden as the President of the United States and minutes before the statutory end of the administration of Donald Trump at noon Eastern time.

The questions that started to surface included: Who is AS8003? Why are they announcing huge amounts of IPv4 space belonging to the U.S. Department of Defense? And perhaps most interestingly, why did it come alive within the final three minutes of the Trump administration?

From the linked article on top, as background info. Quite interesting.

https://www.kentik.com/blog/the-mystery-of-as8003/

greyface-• 5 years ago

motohagiography• 5 years ago

Was going to ask if this was related to that story. I had thought it was announcing space to gather some kind of intelligence about traffic to those networks, or do an attack on the tor network by providing it all as exit nodes.

I also speculated that it's possible it has to do with some kind of internal policy where if you don't use address space in a certain period of time, you lose it or it must be sold, and announcing it created a record of it being in use. Depending on for how long it was announced, the captured one-way traffic to it would provide a snapshot sample of source-dest relationships in that address space for a map.

It could also have just been used as an internal DoD ASN and it got leaked and announced by mistake, with all those routes redistributed into the announcement, though we'd have to look at the data to really recognize that error. A political hypothesis was fun, but unless it yielded evidence of some underlying activity, there seem like other explanations that could indicate the cause.

chaimanmeow• 5 years ago

However, despite the new origin (AS749) these prefixes are still routed exclusively through Hurricane Electric (AS6939)

sounds pretty familiar.

betaby2• 5 years ago

Not a popular idea here, but IPv6 folks. Even for k8s, even for your internal stuff.

zhte415• 5 years ago

Why is IPv6 not a popular idea here?

eppp4• 5 years ago

I work at an ISP and not a single customer has ever even mentioned IPv6. There zero demand on the residential side.

yjftsjthsd-h• 5 years ago

IMO, it is frequently seen as a solution in search of a problem, that breaks things and makes things harder when used to no real benefit. Whether any of that is accurate is left as an exercise for the reader.

fulafel2• 5 years ago

They don't have the vocabulary, but they want internet, which v4 + nat is a watered down version of and hampers apps.

slim• 5 years ago

It's the investor mentality. HN folks seem to view the IPv4 shortage like an opportunity for investement

nemetroid• 5 years ago

HN is largely American, and as far as I know, CGNAT is not as near-universal in the U.S. as it is elsewhere.

justapassenger• 5 years ago

Yes, IPv6 solves this problem.

But in this context - I don't think this is helpful. If you care enough (and have means to do it) to move all of your network to IPv6, then you for sure aren't using DoD space internally.

throwaway47292• 5 years ago

offtopic: ipv6 is fine, but the ipv6 internet is just broken

few days ago I had ipv6 enabled on my pi4 and was trying to update it, turns out that the ipv6 address of archive.raspberrypi.org was returning 404 (its fixed now)

but it took me like 3 seconds to just net.ipv6.conf.all.disable_ipv6 = 1, and i am not gonna enable it until something on ipv4 does not work

(and by ipv6 i mean native ipv6 from my ISP)

it has been like that for the last 15 years, since we gave native ipv6 to our users in my ISP, people just had worse experience than not having it.

markonen• 5 years ago

Right. Dual stack IPv4 + IPv6 is strictly worse for reliability than plain IPv4 because both stacks need to work perfectly or you'll encounter issues. In that sense it provides the opposite of redundancy.

Happy Eyeballs (RFC 8305) is the typically touted solution, but even that doesn't help in the scenario you describe: IPv6 connectivity wasn't broken.

The problem is simply that we now have twice as many things that can go wrong and no plausible route away from dual stack in sight.

lostmsu• 5 years ago

Opened this from RSS feed, because I thought AS8003 is a name of a star or a galaxy.

superdisk• 5 years ago

I figured it was the name of an assembler for a processor called the 8003.

DaiPlusPlus• 5 years ago

I thought it was a flight number and we were about to be hit with months of world news headlines into the investigations of a flight that simply disappeared.

marricks• 5 years ago

I opened it from the site and thought that :(

fourtrees• 5 years ago

I thought it was about the A380's retirement for a few seconds.

cobaltoxide• 5 years ago

Came here because I thought maybe AS8003 was another disappearing aircraft like MAS370.

mlindner• 5 years ago

I'm surprised kentik is still around. They were selling an inferior product to a company I worked at that was bought by Nokia. I figured they would've gone out of business by now.

usr1106• 5 years ago

Nobody wonders why Microsoft is still around. Selling a technically inferior product is not a problem if you can find customers. There can be many reasons. Markets are far from perfect.

guerrilla• 5 years ago

I wonder if the spammers at Global Resource Systems LLC were just covert ops mapping the email space rather than IP.

BTCOG• 5 years ago

Article about AS8003

Entire comment thread is irrelevant bikeshedding.

Did AS8003 just disappear?

Related Stories