Subject: [homenet] Which IP addresses must be avoided?

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 17 May 2016 17:31:39 +0200

Hi,

I just received a bug report for shncpd from somebody who noted that
shncpd's DHCPv4 server will happily assign addresses a.b.c.0 and a.b.c.255
to clients.  That's obviously broken.

Which addresses must be avoided, for both v4 and v6?  I'm already setting
the g and u bits in modified EUI-64 to 0 (silly as it is), what else
should I take care of?

-- Juliusz

---

From: Joe Touch <[email-masked]>
Date: Tue, 17 May 2016 08:54:31 -0700

> On May 17, 2016, at 8:31 AM, Juliusz Chroboczek <[email-masked]> wrote:
> 
> Hi,
> 

Not since 1993 and RFC 1519, depending on the subnet mask.

See also RFC 3021.

> Which addresses must be avoided, for both v4 and v6?

All 0's and all 1's within a subnet range except for /31 in IPv4.

I don't think there are prohibited or reserved interface or group IDs in IPv6. 

Specific addresses and ranges for both, but I think that's a different issue.

Joe

>  I'm already setting
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet

---

From: "Bless, Roland (TM)" <[email-masked]>
Date: Tue, 17 May 2016 18:01:58 +0200

Hi,

> the g and u bits in modified EUI-64 to 0 (silly as it is), what else

https://tools.ietf.org/html/rfc5453
provides an answer w.r.t. IPv6.

https://tools.ietf.org/html/rfc7136
is probably also of interest.

Regards,
 Roland

---

From: Ray Bellis <[email-masked]>
Date: Tue, 17 May 2016 17:35:16 +0100

> to clients.  That's obviously broken.

As others have pointed out, that's actually perfectly legal.

However some operators have (had?) "classful" firewall rules that
prohibit packets that come from IP addresses that would have been
considered a broadcast address in a pre-CIDR world.

This very problem bit me on the backside back in about 2001 when I had
to update the RADIUS server I had written to prevent it from issuing .0
and .255 because my DSL customers getting assigned those addresses
couldn't reach Microsoft's website.

Ray

---

From: Joe Touch <[email-masked]>
Date: Tue, 17 May 2016 09:45:24 -0700

> I don't think there are prohibited or reserved interface or group IDs in IPv6. 

I stand corrected:

> is probably also of interest.

That's a useful pointer, but those two docs aren't the whole story
apparently. The full registry, as created by RFC5354, is here:

http://www.iana.org/assignments/ipv6-interface-ids/ipv6-interface-ids.xhtml#ipv6-interface-ids-1

It's more than I had originally expected and includes all 0s, but not
all 1's.

Joe

---

From: Joe Touch <[email-masked]>
Date: Tue, 17 May 2016 09:49:39 -0700

> considered a broadcast address in a pre-CIDR world.

It's been 23 years since pre-CIDR and 15 years since you experienced
this error.

If we can't assume a fix here, then we can't assume any of the IPv6
reserved IDs are actually reserved either - they could easily be in use
by legacy equipment.

I.e,, the Postel principle applies here:

    - avoid assigning these addresses
    - test your equipment to ensure that they allow these addresses
correctly

If only we had compliance testing (again)....

Joe

---

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 17 May 2016 22:13:38 +0200

> Not since 1993 and RFC 1519, depending on the subnet mask.

Right.  I was thinking of a /24, sorry for not being more precise.

-- Juliusz

---

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 17 May 2016 22:14:47 +0200

> provides an answer w.r.t. IPv6.

Do I need to avoid these addresses when assigning a /128 or a /127?

-- Juliusz

---

From: Joe Touch <[email-masked]>
Date: Tue, 17 May 2016 13:36:57 -0700

> Do I need to avoid these addresses when assigning a /128 or a /127?

Yes - these are reserved IDs. You need to avoid any IPv6 address that
would be the result of using these values as the ID portion.

Joe

---

From: Roland Bless <[email-masked]>
Date: Tue, 17 May 2016 23:15:18 +0200

Hi Juliusz,

> Do I need to avoid these addresses when assigning a /128 or a /127?

Yes, especially the subnet router anycast IID 0000:0000:0000:0000
is widely used and may cause problems if assigned to hosts.
However, as Joe pointed out, the full registry is here:
http://www.iana.org/assignments/ipv6-interface-ids/ipv6-interface-ids.xhtml#ipv6-interface-ids-1

Regards,
 Roland

---

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 17 May 2016 23:25:01 +0200

> would be the result of using these values as the ID portion.

I see, thanks to both of you.

-- Juliusz

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 18 May 2016 10:21:47 +1200

On 18/05/2016 04:01, Bless, Roland (TM) wrote:
...
> is probably also of interest.

In particular, it means you do *not* need specific values for the u/g bits these days.

    Brian

---

From: joel jaeggli <[email-masked]>
Date: Tue, 17 May 2016 15:39:23 -0700

> If only we had compliance testing (again)....

I'm not really concerned that we broke windows95, neither is Microsoft.

We use these IPs for production VIPs and testing in a CDN (as /32s) and
they are fine.

---

From: Mikael Abrahamsson <[email-masked]>
Date: Wed, 18 May 2016 09:02:33 +0200 (CEST)

> We use these IPs for production VIPs and testing in a CDN (as /32s) and 

I have talked to operator colleagues and found several who use .0 and .255 
IPv4 adresses handed out to customers for Internet communication without 
ill effects.

So while this was a problem 10-20 years ago, I'd say it isn't now.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: [email-masked]
Date: Wed, 18 May 2016 10:02:58 +0200

Juliusz,

> Do I need to avoid these addresses when assigning a /128 or a /127?

no. if you assign a /128, that is a single address, the length of the IID is zero.
the case of /127 is a little trickier, since then one end will get the subnet-router anycast address.
as long as both ends of the /127 agree, that's not a problem.

Best regards,
Ole

---

From: Ray Bellis <[email-masked]>
Date: Wed, 18 May 2016 09:16:46 +0100

On 18/05/2016 08:02, Mikael Abrahamsson wrote:

> I have talked to operator colleagues and found several who use .0 and
> .255 IPv4 adresses handed out to customers for Internet communication
> without ill effects.
> 

I'm glad to hear this!

thanks,

Ray

---

From: Joe Touch <[email-masked]>
Date: Wed, 18 May 2016 11:49:52 -0700

> no. if you assign a /128, that is a single address, the length of the IID is zero.

A /128 seems like it indicates that the entire address is the IID.
There's no "network" part left if it refers to a single address.

> The case of /127 is a little trickier, since then one end will get the subnet-router anycast address.

See RFC 6164. It's supposed to be standard to allow use for 2 addresses
on a point-to-point link.

Joe

---

From: Juliusz Chroboczek <[email-masked]>
Date: Wed, 18 May 2016 21:58:12 +0200

> IPv4 adresses handed out to customers for Internet communication without

The customers are probably behind NAT, so I'm not sure how much that says
about the compatibility of client devices.

> So while this was a problem 10-20 years ago, I'd say it isn't now.

Agreed, let's not avoid these addresses.  (Although the point is somewhat
academic in the case of both hnetd and shncpd, which assign /24 by default.)

-- Juliusz