UK.gov squatting on £1bn IPv4 motherlode The UK's Department for Work and Pensions is sitting on up to £1bn worth of IPv4 addresses that it is not using, according to an online petition. The epetition was sparked by a blog posting from programmer John Graham-Cumming, who spotted the /8 block of addresses, over 16.8 million, was completely unused on the Autonomous …
Not at all. Administration across multiple administrative realms becomes an impossible headache if you have to muddle around in RFC1918 space. Not to mention that they registered their space in 1994, predating RFC1918 by more than a year.
The DWP did the fine and perfectly acceptable thing to register a block and use it. No guarantees that it should be reachable from the public internet, that's entirely up to them. No, the current dearth of IPv4 address space and lack of uptake of IPv6 does not change that.
The nonsense is this pro-grammer starting an e-petition decrying something that's essentially right and proper, demonstrating that he is in fact another idiot besserwisser without a clue outside his cosy little internet-connected world. As becomes perfectly clear when you but consider the cost of clearing out the space, that will not in the least be covered by flogging it off.
It's slightly less right and proper now we know what's it's worth to the public purse. Are you seriously suggesting it would cost a billion to do some network reconfiguration? (If the cost approaches a fraction of that amount, it's a tacit admission the work is in dire need of doing anyway. How much is the inevitable migration from IPv4 within the DWP cost us?)
If the space is that precious to the DWP, let them not route it to the outside world and then fix things as they break.
And best to do it now while it's still worth anything.
Correct - GSI routing uses non-private IP addresses in order to be able to unambiguously route from Govt Departments which connect to multiple private networks. With hindsight, if each govt dept had avoided using the 10. private address space, this could have been used by GSI, thus avoiding the use of a chunk (but ONLY a chunk of, not all) of the 51. space. There is probably a large percentage of the 51. space remanining unused which could be recycled.
= CLUELESS.
This isn't some home ADSL/NAT setup: the address space IS used internally. Has been for years. Can you even begin to imagine the job of re-addressing everything, not to mention testing ALL the services that use those networks, including some VERY BIG and VERY CRITICAL ones??
"More than half a billion?"
Yep. Easily, even if it were technically possible.
Let's accept their estimate of 80% usage. That means that whatever range you replace it with is effectively a class A range. This network connects a lot of networks that require access to the Internet, so whatever range you use must be in RFC1918. SO, the easiest option is to use 10.x.x.x.
OK, that's the easy bit out of the way, to enable communications across this network, it is your task to organise and re-number the internal networks of every government department, every local council, school, police authority, fire service etc. etc. so that they do not use any 10.x.x.x address internally (to ensure that they can reach any and all services on the network) and then go round and do the same for all the private companies that have a need for direct communications with any aspect of government.
If you can do that for less than half a billion and within a time-scale so that the whole exercise isn't pointless I'll buy you that pint to the left!
Why not use this as an opportunity to migrate to IPv6 and sell the IPv4 address block while it's still worth something?
At least then you can off-set the cost of the migration in whole or in part. If they wait much longer they'll have migrated to IPv6 anyway and the IPv4 block will be worthless.
"... and sell the IPv4 address block while it's still worth something?"
Because that'd mean having the DWP move faster than glacially slow. This is the government we're talking about, after all. Beyond that, it's bound to be interesting in the Chinese sense in that it is guaranteed to unearth and uproot just about everything on all the attached networks, from the very newest to the very oldest. What percentage of the devices involved, would you wager, would be unable to talk IPv6 at all?
Given that sprinkling the networks with various 4-to-6 bodges aren't acceptable as the final design, that means replacing at least that percentage of attached devices as well as revamping the network design. And then you'll find that a well-used /8 is quite a large space.
So it's going to be costly, perhaps roughly on the same order as swapping out the floggable space for 10/8. And that for a gain that doesn't offset the costs. This again neatly turns the "Why not?" into a "Why bother?" Especially since government departments are adept at spending other people's tax money already. No need to stoke that fire, eh.
@djack - you misunderstand routing quite seriously. There's no reason whatsoever for the DWP to hold on to 16 million internet useable addresses for internal use. All of that can be handled quite easily using 10.x.x.x ranges, routers and using brains to design your network properly.
External facing services, which companies will connect to, would still use public routable addresses, but internally? Why? Look at somewhere like the SWGfL in education. All the addresses internally to that are 10.x.x.x, and that's used by thousands of schools, which connect to each other, and to LEA provided services. External facing services are assigned public IPs which then get either NATed or routed normally.
Re-addressing it all would not cost half a billion quid, that's preposterous.
"All of that can be handled quite easily using 10.x.x.x ranges, routers and using brains to design your network properly."
It may be theoretically possible. Then again, it may not. I assume that many of the networks in this range allow clients to VPN in from outside. If the other end of that VPN is itself on a network lazily set up as 10.x.x.x/8 (which is by no means uncommon and beyond your control) then routing doesn't work.
However, even if it *is* possible, you still have to prove that this job (including re-testing every bleedin' system in the DWP) is cheaper than saying "FFS, switch to IPv6 you numbskull!". It's ready. Many people in many parts of the world are already using it. ISPs support it. Even for the domestic market, routers that support it are now available.
Yes there are still idiot ISPs and vendors who don't. Who gives a toss about them? They won't be in business next year. Why should the UK taxpayer subsidize the band-aid for these vendors lack of preparation?
Government IT contract to do the job, yeah, half a billion at least, more like 4 times that.
I say go ahead and let them remap it. I'm prepared to offer my services for a nice fee. Should keep a lot of people working on it for the next 5 years at gov IT time scales. By which time it will be abandonned and they'll be forced to go IPv6 and we can all move on to the next waste of money ludicrous gov IT project.
They used a public address space internally (probably this one). Yeah it's wasteful but I imagine they began doing this LONG before the idea of using NAT, and running out of IPv4, was ever considered. And I imagine it would cost close to that £1bn for the project to re-address everything!
Ah, this suggestion originated from a PROGRAMMER?? That explains it then - no idea of the real world! :-)
Really? Assuming that we pay contractors £300 a day, you figure it would take 3.3 million man-days to change the IP addresses of the kit in a government department? 9,100 man-years? You're the one with no idea of the real world... don't suppose you work in the civil service as an IT procurement manager, by any chance, if you consider a £1 billion price tag on the job to be reasonable?
Whilst they could migrate onto a private address space with a handful of public addresses, it probably isn't worth it.
The fact that private companies in the same situation aren't bothering means they don't see it being worth the cost and more importantly, risk to service. By the time they've actually freed up the range it'll probably be worth less than they've spent on the army of contract engineers, PMs, BAs, etc etc, and more likely they'll get half way through, there'll be a change of minister and they'd try to go back.
According to a 2007 report the DWP has ~125,000 staff. Even assuming there are 2 computers per employee, you're saying it will cost £4000 to remap each computer.
It's worth what someone would pay for it... Nobody has $1b to spend. They'd also have to do it underhand anyway as under RIPE rules they can't sell it, only relinquish it back to RIPE for $0.
The whole thing's pretty silly. Even if it *was* released back into the pool it pushes back exhaustion about a month. Then you're back to square one except you've spent millions forcing several government departments to restructure for no reason.
Yes, and no. Time is of the essence but speed isn't. The price of an IPv4 block will rise while they become increasingly scarce. For a while they will be interesting to companies that can't move to IPv6 (yet).
Until the moment that still having IPv4 becomes less necessary and staying on IPv4 is more expensive than moving to IPv6. At that point the price for an IPv4 block will plummet. My guess would be that that point is four years away.
If the DWP's objective was to profit from speculation they'd better hold on to it for some time. Fortunately they have other objectives and spending a lot of money on a major network overhaul that will take a few years to complete is, in the current state of the economy, madness.
This is hardly news - or newsworthy.
When you look at the list, it's plain that huge tracts of IP addresses were given to all and sundry when the internet was new, empty and ran on modems. Apart from the easily-kicked target of the british govt. there are loads of companies that are also sitting on /8's. Ford Motors, Eli Lilly (who?), the long-defunct DEC. Hell: even Apple have a slice of the pie.
If there's any policy worth pursuing here it would be a "use it or lose it" across the whole 32-bit address range. Not just picking on the usual suspects.
> Apart from the easily-kicked target of the british govt. there are loads of companies that are also sitting on /8's. Ford Motors, Eli Lilly (who?), the long-defunct DEC. Hell: even Apple have a slice of the pie.
And if you can tell me how I can force these companies to tell me what they are doing with these addresses I will do it.
If isn't just that the British govt is an easy target, it is because they have to respond.
Tis true: the vast majority of IPv4 addresses were issued to companies and institutions in the USA. Getting them released would make a difference whereas releasing the odd range in Europe is a bit like rearranging deckchairs on the Titanic, to stick with the iceberg metaphor.
Much better to have whichever government department or Quango is responsible for internet agree a timetable for the mandatory phasing in of IPv6 with ISPs. Pretty much all the equipment in all the networks can do IPv6 as can the vast majority of consumer's computers so the marginal cost would be minimal. You have to ask yourself that what, apart from complacency or ineptitude, is holding ISPs back?
IPv6 really isn't that scary and solves a lot of the problems that weren't envisaged when v4 was designed. It doesn't solve everything but there are at least enough transitional technologies out there to make it work. Good provider support is the key to getting it moving though, I know of plenty of corporate grade network providers who still don't support dual stack v4/v6 connections and that's a big ballache for those who are ready because a v6 network is next to useless if you can't get on the internet.
IMHO all the original /8 networks should be forced to give up their address space though. How many addresses does iTunes need?
There's still a few Ip addresses left, though supply is admittedly circling the drain just now.
Wait until AFTER they've run out before selling, you'll get more for them!
Don't do a Gordon Brown and flog off a valuable resource when it's only set to become more valuable later
There's always something you can do. Like assign the IP addresses to a distinct business unit, then flog that. Then whoever buys that unit reassignes the IP addresses to its own relevant department and dissolves the unit. All done nicely through company restructuring and flogging processes, not involving RIPE or equivalent except maybe to update their records.
Can't move the item as is? You find a vehicle that can move the item, then move the vehicle. Man with a van for IP addresses. If you're clever, you might even be able to claim it as a loss towards your profits when you dissolve the purchased unit (some ad company MS dumped recently gave me this idea).
They have done it a few times.
More worryingly, large tracts of "unused" space are prime targets for route hijacking. Spammers use such things ephemerally to send out untraceable attacks, whilst forged documents have been routinely used since the late 1990s to grab such spaces.
Space which is allocated, used internally but not routed to the 'net at large are particularly vulnerable to these hijackings - mainly because noone notices.
In any subnet, at least two addresses are unusable: the one with all the low-order bits zero (network address, e.g. 51.0.0.0) and the one with all the low-order bits one (broadcast address, e.g. 51.255.255.255). And by convention, the one with just the lowest-order bit one (e.g. 51.0.0.1) is reserved for the router.
A single /8 wastes just 3 potential IPv4 addresses. 65536 separate /24s would be wasting 196608 potential addresses; while 1048576 separate /28s would be wasting a whopping 3145728 addresses!
A single /8 wastes just 3 potential IPv4 addresses. 65536 separate /24s would be wasting 196608 potential addresses; while 1048576 separate /28s would be wasting a whopping 3145728 addresses!
Or again; a non publicly routeable /8 wastes the full 16,777,216 potential addresses.
"In any subnet, at least two addresses are unusable: the one with all the low-order bits zero (network address, e.g. 51.0.0.0)"
That's RFC950 thinking, not RFC1878. Or even post-IOS 12.0. CIDR made some aspects of old-school thinking obsolete and you can happily use subnet zero (most of the time). Far more IP addresses are probably wasted by people assigning /30s to point-point links when they don't need to. See RFC3021 for more info.
"It's also the number of colours in the RGB palette (256^3)."
No it isn't, that would be infinity. Though by quantizing it at 256 levels per channel you actually end up with many repetitions of the same set of colours at differing brightness or saturation.
(Also RGB HDMI uses 30 bits per pixel.)
I sit here with everything around me on the GE /8 subnet, with stupid amounts of resouces committed to stopping me accessing most of those numbers and significant chunks of the outside world. Attempted IPv6 traffic (even via tunnelling) goes nowhere! There are some very active systems admin ludites out there!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
