IPv6 bogons

Posted by Andree Toonk - November 2, 2008 - bogons, IPv6 - 2 Comments
BGPmon is gradually being extended with IPv6 support, the newest IPv6 feature is IPv6 bogon detection comparable to the already existing IPv4 bogon detection page. IPv6 bogons are defined as IPv6 prefixes which are not allocated by the RIRs.  All IPv6 bgp updates are compared to a list of known valid prefixes. If the update does not match this known prefixes list it is considered as a IPv6 bogon. The result can be found here:  http://www.bgpmon.net/showbogons.php?inet=6&global As you will probably see, there's quite a few strange IPv6 prefixes out there, looking like: a3c7:8800::/21 and a51e::/16 and many more. I'm not sure what this is, it's not a bug in the BGPmon.net software as the same updates are seen by RIS (see here).  The announcements are very short, typically an announcement for these prefixes is followed by a withdraw just 1 second later. The (same) bogon prefixes are actually being announced by a number of origin AS's looking a bit further shows that the one common thing is the rest of the AS path. So it could mean that somewhere in the transit path a faulty router is the cause of this. But that's all guessing and if we go there we shouldn't eliminate a bug in the RIS software. If anyone has any information about this, please leave a comment on this blog or sent me an email.

2 comments

  • andree says:

    Interesting is that the majority of these ‘weird’ prefixes seem to be a hexadecimal representation of IPv4 prefixes. For example:

    cc8c:f00::/24 > 204.140.240.0/24
    cd84:ae00::/24 > 205.132.174.0/24
    c805:dd00::/24 > 200.5.221.0/24

    However the ASpath in these advertisement don’t seem to be related to the prefix.
    Strange & Interesting problem 🙂

  • fff says:

    “Often an address will have long substrings of all zeros therefore one such substring per address can be abbreviated by “::”. Also up to three leading “0”s per hexquad can be omitted. For example fe80::1 corresponds to the canonical form fe80:0000:0000:0000:0000:0000:0000:0001.”

Leave a Reply

Your email address will not be published. Required fields are marked *