The Team Cymru Bogon List v4.1 14 FEB 2008

noc@cymru.com

[ Documents ] [ Home ]

Changes in version 4.1 (14 FEB 2008)

173/8 and 174/8 allocated to ARIN (FEB 2008). Removed from the bogon lists.

Changes in version 4.0 (25 JAN 2008)

14/8 changed to IANA RESERVED (JAN 2008). Added to the bogon lists.

Changes in version 3.9 (29 OCT 2007)

114/8 and 115/8 allocated to APNIC (OCT 2007). Removed from the bogon lists.

Changes in version 3.8 (28 SEP 2007)

186/8 and 187/8 allocated to LACNIC (SEP 2007). Removed from the bogon lists.

Changes in version 3.7 (27 JUL 2007)

94/8 and 95/8 allocated to RIPE (JUL 2007). Removed from the bogon lists.

Changes in version 3.6 (23 MAY 2007)

46/8 re-listed as IANA Reserved (APR 07). Added to the bogon lists. Removed 7/8 from bogon list due to dispute in allocation status.

Changes in version 3.5 (27 MAR 2007)

92/8 and 93/8 allocated to RIPE (MAR 2007). Removed from the bogon lists.

Changes in version 3.4 (22 JAN 2007)

116/8, 117/8, 118/8, 119/8 and 120/8 allocated to APNIC (JAN 2007). Removed from the bogon lists.

Changes in version 3.3 (12 OCT 2006)

96/8, 97/8, 98/8 and 99/8 allocated to ARIN (OCT 2006). Removed from the bogon lists.

Changes in version 3.2 (31 AUG 2006)

77/8, 78/8 and 79/8 allocated to RIPE (AUG 2006). Removed from the bogon lists.

Changes in version 3.1 (05 JAN 2006)

121/8, 122/8 and 123/8 allocated to APNIC (JAN 2006). Removed from the bogon lists.

Changes in version 3.0 (30 JUN 2005)

89/8, 90/8 and 91/8 allocated to RIPE (JUN 2005). Removed from the bogon lists.

Changes in version 2.9 (17 JUN 2005)

74/8, 75/8 and 76/8 allocated to ARIN (JUN 2005). Removed from the bogon lists.
189/8 and 190/8 allocated to LACNIC (JUN 2005). Removed from the bogon lists.

Changes in version 2.8 (12 APR 2005)

41/8 allocated to AfriNIC (APR 2005). Removed from the bogon lists.

Changes in version 2.7 (30 MAR 2005)

73/8 allocated to ARIN (MAR 2005). Removed from the bogon lists.

Changes in version 2.6 (27 JAN 2005)

124/8, 125/8 and 126/8 allocated to APNIC (JAN 2005). Removed from the bogon lists.

Changes in version 2.5 (02 AUG 2004)

71/8 and 72/8 allocated to ARIN (AUG 2004). Removed from the bogon lists.

Changes in version 2.4 (28 APR 2004)

58/8 and 59/8 allocated to the APNIC (APR 2004). Removed from the bogon lists.

Changes in version 2.3 (01 APR 2004)

85/8, 86/8, 87/8, and 88/8 allocated to the RIPE NCC (APR 2004). Removed from the bogon lists.

Changes in version 2.2 (15 JAN 2004)

70/8 allocated to ARIN (JAN 2004). Removed from the bogon lists.

Changes in version 2.1 (16 NOV 2003)

83/8 and 84/8 allocated to RIPE NCC (NOV 2003). Removed from the bogon lists.

Changes in version 2.0 (08 APR 2003)

APNIC returned the 223/8 allocation to IANA and received the 60/8 allocation in its place on 07 April 2003.

Changes in version 1.9 (06 APR 2003)

Added the following netblocks to the bogon filters, designated as RESERVED by IANA on 04 April 2003:

		173/8   Apr 03   IANA - Reserved
		174/8   Apr 03   IANA - Reserved
		175/8   Apr 03   IANA - Reserved
		176/8   Apr 03   IANA - Reserved
		177/8   Apr 03   IANA - Reserved
		178/8   Apr 03   IANA - Reserved
		179/8   Apr 03   IANA - Reserved
		180/8   Apr 03   IANA - Reserved
		181/8   Apr 03   IANA - Reserved
		182/8   Apr 03   IANA - Reserved
		183/8   Apr 03   IANA - Reserved
		184/8   Apr 03   IANA - Reserved
		185/8   Apr 03   IANA - Reserved
		186/8   Apr 03   IANA - Reserved
		187/8   Apr 03   IANA - Reserved
		189/8   Apr 03   IANA - Reserved
		190/8   Apr 03   IANA - Reserved

Changes in version 1.8 (04 APR 2003)

201/8 allocated to LACNIC (APR 2003). Removed from the bogon lists.
Added links to text file versions of the bit notation bogon lists.

Changes in version 1.7.1 (13 FEB 2003)

Removed 222/8 and 223/8 (allocated to APNIC FEB 2003) from the bogon filters.

Changes in version 1.7.0 (05 FEB 2003, dotted decimal only)

Corrected 58.0.0.0 255.0.0.0 and 59.0.0.0 255.0.0.0 to be 58.0.0.0 254.0.0.0 on the dotted decimal aggregated list. Thanks, Tom! :)

Changes in version 1.6

82/8 allocated to RIPE (NOV 2002). Removed from bogon lists.

Changes in version 1.5

69/8 allocated to ARIN (AUG 2002). Removed from bogon lists.

Changes in version 1.4

Removed 192.88.99.0/24 (RFC 3068) from the bogon list.

Changes in version 1.3

Added 198.18.0.0/15 (RFC 2544) and 192.88.99.0/24 (RFC 3068).

Changes in version 1.2

221/8 allocated to APNIC. Removed from bogon lists.

Introduction

I am often asked to provide a list of the bogon ranges. Bogons are prefixes that should never appear in the Internet routing table, and obviously should not appear as the source address in any packets you receive.

Such a list is convenient for use in ACLs, null routes, BIND ACLs, log file analysis, and the like. Unfortunately, none of these use exactly the same syntax. This list will provide the bogon ranges in a variety of formats, and I hope one or more of these formats will meet your requirements. As an added bonus, I am also including the bogon prefixes in both aggregated and non-aggregated (/8, mostly) formats.

I will update this document as IANA allocates prefixes to the RIRs. Please review the documents included in the References section.

Sorry about all the links, but including all of the bogon samples in one page makes for a very large page. :)

I hope this helps! Comments and suggestions are always welcome.

Credits

I am always questing for clueful assistance and input, and the following folks were kind enough to share such with me. Thank you!

John Dorsey

Erik Fichtner

Stephen Griffin

Tom Hash

Boyan Krosnov

David Luyer

Jared Mauch

Andrew Prins

Doron Shikmoni

Philip Smith

Richard Steenbergen

Peter van Oene

Eric Van Tol

And, of course, the FIRST community!

References

IANA IPv4 Allocation Reference

RFC3330 Special-Use IPv4 Addresses. This is a RFC that lists and explains the special-use netblocks.

Secure IOS Template. This template ensures that bogons can not enter or exit your border.

Secure BGP Template. This template prevents the announcement or acceptance of bogons by your BGP speaking routers.

Secure BIND Template. This template ensures that bogon sourced packets can not hit your name server for queries, updates, etc.

Bogon Prefixes. My bogon prefix tracking page.

Bogus ASNs. My bogus ASN tracking page.

Bogonet The Bogon Tracking Page and Database, by Pascal Gloor.

Caveats

While I list the Multicast ranges in the bogon lists, this may not work on your network. Multicast != bogon in many cases. :) If your network supports Multicast, please do not block it.

Many networks use RFC1918 addresses internally. While these addresses should not leak out into the Internet, be very careful where you apply these filters.

NOTE WELL! IANA allocations change over time, so please check back regularly to ensure you have the latest filters. I do announce updates to my templates in the FIRST community, as well as on lists such as NANOG, isp-routing, isp-security, isp-bgp, and cisco-nsp. I can not stress this point strongly enough - these allocations change, as often as every four months. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. You have been warned!

In short, there is rarely a "one size fits all" solution in networking. It comes down to understanding the business and technical requirements of your network, and knowing how to verify that those requirements have been met. Please do not blindly apply any filters or blocks to your network without carefully considering the ramifications of such filters.

KNOW YOUR NETWORK. :)

Meet the Bogons

Dotted Decimal Bogons

Bit Notation Bogons

Bit Notation Text, Aggregated

Bit Notation Text, Not Aggregated

Conclusion

Miscreants routinely spoof the source of their attack packets, and this spoofing often comes from bogon ranges. At times private ranges (e.g. the RFC1918 netblocks) will leak out into the Internet routing table. In both cases it is important that a network neither accept nor announce such ranges and contribute to the instability of the Internet or an attack against an Internet-connected device or network. Filtering of the bogons is an important task for all good netizens to accomplish.

[ Documents ] [ Home ]

Team Cymru
noc@cymru.com
http://www.cymru.com