New on RIPE Labs: The Curious Case of 128.0/16

Dear colleagues,

Related to the discussion about 128.0/16, we did some measurements. The details can be found on RIPE Labs:

https://labs.ripe.net/Members/emileaben/the-curious-case-of-128.0-16

Kind regards,
Mirjam Kuehne
RIPE NCC

Once upon a time, Mirjam Kuehne <mir@ripe.net> said:

Dear colleagues,

Related to the discussion about 128.0/16, we did some measurements. The
details can be found on RIPE Labs:

The Curious Case of 128.0/16 | RIPE Labs

Kind regards,
Mirjam Kuehne
RIPE NCC

Using RIPE's traceroute web interface, I can see that Sprint is
filtering 128.0.0.0/16:

from 128.0.0.1
traceroute to 216.180.54.1 (216.180.54.1), 30 hops max, 40 byte packets
1 gw.nik-guest.nikrtr.ripe.net (193.0.0.234) 0.803 ms 1.005 ms 1.061 ms
2 ams16-core-1.gigabiteth8-1-0.swip.net (195.69.145.139) 0.551 ms 0.466 ms 0.641 ms
3 ams-core-1.tengige0-0-0-6.tele2.net (130.244.49.198) 3.378 ms 3.467 ms 3.624 ms
4 nyc9-core-1.pos8-0-0.tele2.net (130.244.218.214) 76.618 ms 76.683 ms 76.746 ms
5 * * *

from 193.0.0.232
traceroute to 216.180.54.1 (216.180.54.1), 30 hops max, 40 byte packets
1 gw.nik-guest.nikrtr.ripe.net (193.0.0.234) 0.466 ms 0.514 ms 0.608 ms
2 ams16-core-1.gigabiteth8-1-0.swip.net (195.69.145.139) 0.684 ms 0.581 ms 0.563 ms
3 ams-core-1.tengige0-0-0-6.tele2.net (130.244.49.198) 3.890 ms 3.919 ms 3.912 ms
4 nyc9-core-1.pos8-0-0.tele2.net (130.244.218.214) 76.292 ms 76.317 ms 76.304 ms
5 144.223.26.73 (144.223.26.73) 76.639 ms 76.475 ms 76.511 ms
(and on to my IP)

I believe that Sprint is using Cisco, not Juniper. This is either a
manual filter or there is another (unidentified) issue with some Cisco
configurations.

I've opened a ticket with Sprint, although I don't know how far it will
go, since I'm getting a MySQL syntax error trying to view the ticket in
their web interface (somebody must not understand SQL injection security
issues).

People are less likely to read an RFC changing the reserved addresses. Even people who didn't filter unassigned addressing, might filter RFC reserved addressing. The fact that it's built into some routers automatically kind of makes the point.

Jack

I've been getting spam from NTT for several days in that range; a Sprint-based
traceroute:

   2 sl-gw28-nyc-15-1-3-28-ts0.sprintlink.net (160.81.237.61) 10.880 ms 10.604 ms 9.359 ms
   3 sl-crs1-nyc-0-6-3-0.sprintlink.net (144.232.3.188) 10.345 ms 10.559 ms
  11.802 ms
   4 144.232.4.87 (144.232.4.87) 9.178 ms 7.928 ms 144.232.4.91 (144.232.4.91) 9.304 ms
   5 xe-0-2-0-2.r06.nycmny01.us.bb.gin.ntt.net (129.250.8.73) 8.841 ms 9.977 ms 7.947 ms
   6 ae-2.r22.nycmny01.us.bb.gin.ntt.net (129.250.4.174) 11.497 ms 10.610 ms
   11.682 ms
   7 ae-4.r21.sttlwa01.us.bb.gin.ntt.net (129.250.2.51) 85.541 ms 86.744 ms
  84.994 ms
   8 ae-0.r20.sttlwa01.us.bb.gin.ntt.net (129.250.2.53) 88.498 ms 87.313 ms
  88.387 ms
   9 ae-3.r20.snjsca04.us.bb.gin.ntt.net (129.250.3.53) 95.862 ms 96.692 ms
  96.558 ms
  10 ae-2.r20.mlpsca01.us.bb.gin.ntt.net (129.250.5.6) 97.193 ms 96.742 ms 97.046 ms
  11 * * *
  12 ae-0.r01.mlpsca01.us.wh.verio.net (129.250.26.170) 98.053 ms 97.402 ms
  95.332 ms
  13 ge-26.a0410i.mlpsca01.us.wh.verio.net (204.202.1.226) 99.151 ms 99.001 ms 96.926 ms
  14 ca1-lam00092.vwh.net (192.217.122.217) 95.274 ms 97.104 ms 96.247 ms
  15 arnmarkt.org (128.121.86.33) 90.872 ms 91.109 ms 91.995 ms

Once upon a time, Chris Adams <cmadams@hiwaay.net> said:

Using RIPE's traceroute web interface, I can see that Sprint is
filtering 128.0.0.0/16:

Sprint is now passing routes and traffic in 128.0.0.0/16.