Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there an IP address that would result in any packet sent to be ignored (blackholed)?

I know I can always set up a router with an IP address and then just have it ignore all packets sent to it, but does such a thing exist to save me the trouble?

share|improve this question
    
There are some devices (like routers and switches from that San Fran**cisco** co.) that use a Null interface that could be used as a black hole to malicious traffic. One should point a route to that Null interface so all traffic to that route be discarded. –  Adriano P Jan 8 at 16:22
4  
you may be interested in devnull-as-a-service.com –  WChargin Jan 8 at 23:28
    
I am curious, why is the question tagged "spam-prevention"? –  Mike Pennington Jan 9 at 2:44
    
@WChargin, I hope that was a joke - devnull-as-a-service.com does not seem to have anything to do with networking and even it does look like a crap. What is this: When we say "government" we mean NSA, CIA, FBI, TSA, Communist Party of China (CPC), Nestle, The Coca-Cola Company, the KGB, some of your coworkers and our friends (especially if there is something funny).? –  Nikolay Jan 10 at 14:29
1  
@Nikolay yes, it was a joke, as is the website. See their Github README: "It's mostly about the enterprise, cloud, *-as-a-Service and criticism on it." (emphasis mine) –  WChargin Jan 10 at 15:23

7 Answers 7

up vote 63 down vote accepted

There's specifically a blackhole prefix in IPV6, as described in RFC 6666, it's 100::/64. IP4 does not have an explicit black hole like that, but a non-existent host on one of the reserved blocks would have that effect. (e.g., 240.0.0.0/4 is "reserved for future use" and will not be routed by anything.)

share|improve this answer
31  
RFC 6666, black holes? This has to be black network magic! ;) –  klingt.net Jan 8 at 8:29
17  
Sending data to something reserved for future use is only a good idea until that future use is realized. –  corsiKa Jan 8 at 19:12
3  
Very good point, though I highly doubt that IP4 will be expanded much again. –  Bandrami Jan 9 at 4:28
    
But is the router guaranteed to drop the packets? Because if it returns ICMP "destination unreachable", it would be not what the OP asked for. –  WGH Mar 22 at 14:28

There is such a thing as network Black hole.

If there are no devices in the network with IP address 192.168.0.10, then this IP address is kind of black hole and it will "discard" all the traffic to it, simply because it does not exist.

Protocols which keep track of connection state (TCP) can detect a missing destination host. It will not happen with UDP and packets will just die while the sending host will not be informed about that.

You can setup black hole with firewall by setting it up to silently drop packets (not reject) from particular (or many) addresses.

As far as I know there is no such network standard address which will do black hole for you in TCP/IP version 4 (Thanks to Bandrami).

So you have two options:

  1. An IP address which was not assigned to any host;
  2. Host with firewall which silently drops packets or variations of it, for example using netcat: (as suggested by ultrasawblade).

nc -vv -l 25 > /dev/null will listen for inbound connections on TCP port 25 and pipe the results to /dev/null. More examples here.

The entire subnet also can be a black hole (Null route).

share|improve this answer
3  
If you want something that will receive TCP traffic, but do nothing with it, something quick can be setup with nc (or netcat). As @Nikolay says though, there's not a "blackhole" IP that does this automatically. –  ultrasawblade Jan 7 at 18:00
2  
At least not in IP4 –  Bandrami Jan 7 at 18:07
    
Thank you guys, I edited my post based on your comments. –  Nikolay Jan 7 at 18:16
    
@Bandrami: What about IPv6, then? –  user2357112 Jan 8 at 1:45
1  
@user2357112, just look at his answer. It is just below mine. –  Nikolay Jan 8 at 1:46

There's no "standard blackhole address" as such, nor is there really any requirement for it. You don't say what you're actually trying to achieve, so I can't help you do so, but here are some wrong solutions for your problem that would answer your question as you asked it:

  • You can use an RFC1918 address that's not in use on your network and rely on your ISP to drop it for you. For example, if you're only using some parts of 192.168, 10.255.255.1 would be null-routed by your ISP (which would get it thanks to your default gateway).
  • You can use an IP address that's reserved for future use (and will probably never be used); that's the old "Class E" range. It'll do the same as above, but will work even if you use all of the private address ranges already (by having much broader netmasks than necessary, I doubt that you'll have millions of attached devices). For example, 254.0.0.1 will never (legally) refer to a real device.
  • On the machine where you need this, you can add a drop-only target; using an unused address such as the above, for example, iptables -I OUTPUT -d 254.0.0.0/8 -j DROP will ensure anything sent to that "network" will be silently dropped instead of bothering any gateways, or even causing traffic on the actual network interface.

Again, you probably don't actually want any of this, even if you think it's convenient - it's not, it's confusing and non-obvious and not a good solution to whatever your problem really is.

share|improve this answer
    
254.0.0.1 does not black hole packets, I get a "transmit failure" error. –  Tyler Durden Jan 7 at 18:09
6  
+1 for "you probably don't actually want any of this..." –  RBerteig Jan 7 at 21:57
    
How can we upvote something that the author specifically claims isn't useful? O_o –  corsiKa Jan 8 at 19:14

While it isn't a black-hole, you might also want to consider the IPs set aside for test/example purposes, especially if your goal is a "safely non-working default" value.

  • 192.0.2.0/24 (TEST-NET-1),
  • 198.51.100.0/24 (TEST-NET-2)
  • 203.0.113.0/24 (TEST-NET-3)

Network operators SHOULD add these address blocks to the list of non-routeable address spaces, and if packet filters are deployed, then this address block SHOULD be added to packet filters.

There's no guarantee that packets to those addresses will be blocked (that depends on your ISP, etc.) but certainly nobody should be already using them.

share|improve this answer
    
They can also be REJECTed instead of DROPped, so… –  mirabilos Jan 8 at 19:57

Side stepping your question, what about using the "discard protocol"?

share|improve this answer

One thing to consider (which may or may not be a problem for your particular scenario) is that if you redirect traffic to an IP address that does not exist, the router and/or host may attempt to continuously ARP for that address, which could be a bad thing.

If you configure a static ARP<->IP binding for this phantom address, then the system will always have a resolved ARP entry, and it will just put the packet on the wire with that ARP address (which, assumedly, is bogus) and the traffic won't actually land anywhere.

Again, this may very well NOT be what you actually want, but it's worth considering.

share|improve this answer

Depending on what you are attempting, 127.0.0.1 is a blackhole.

http://en.wikipedia.org/wiki/Loopback

share|improve this answer
8  
Sorry, but in question it says : Is there an IP address that would result in any packet sent to be ignored. 127.0.0.1 will not ignore the packets. –  Nikolay Jan 7 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.