16

Today I accidentally discovered, that I can ping addresses in the 172.31.0.0/16 subnet and get an ICMP reply. I tried a few random ones, it always got replies. After checking the routing table and a tentative traceroute,it looks like the associated packets are leaving my local network, i.e. leaving towards my ISP. My local network uses a different IP range, part of the 192.168.0.0/16 subnet and there are Docker-related interfaces for 172.17.0.0/16 and 172.19.0.0/16, but not 172.31.0.0/16.

It was my understanding that 172.31.0.0/16 should still be part of the of the 172.16.0.0/12 IANA-reserved address space.

I tried a web search to see whether the range of this subnet might have been shortened due to global IP address shortage or any other reason but couldn't find anything to support that hypothesis.

Now I'm wondering whether I'm just lacking some sleep and overlooking something elementary or whether there's something seriously borked in my networking setup.

24

You are correct that 172.31.0.0/16 is part of the RFC1918 IP address space. Your router is most probably configured to dump traffic towards non-connected routes to it's default gateway, your ISP. That's where the traffic should stop.

However, it seems your ISP has made this address range routable. I've seen this happen in the past with other ISPs (Tele2 for example, used 1.0.0.0/8 for their backbone before it was assigned by IANA).

Either way, you (and your ISP) should probably implement bogon filtering and/or martian filtering on the borders of your networks. For the average home consumer, this is excusable, but an ISP should know better.

To avoid this issue, you could set up a basic outgoing filter on your router's firewall (eg 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16). Another option is to null route or black hole route these address ranges. Your router will then drop the packets.

4
  • 4
    Note that while IPv4 localhost at the moment is 127.0.0.1/8, there is an proposal RFC to update this to 127.0.0.1/16, see ietf.org/id/draft-schoen-intarea-unicast-127-00.html
    – Ferrybig
    Dec 3 '21 at 14:56
  • Nit: 127.0.0.1 is a single address in both the 127.0.0.0/8 and 127.0.0.0/16 prefixes.
    – chepner
    Dec 4 '21 at 15:50
  • Since the OP is (presumably) not a BGP speaker, it's fine for the ISP to be using 172.31/16 internally, as long as they don't send any such packets outside their AS.
    – chepner
    Dec 4 '21 at 15:53
  • @Ferrybig a proposal that seems unlikely to be approved. See for example the thread starting with mailman.nanog.org/pipermail/nanog/2021-November/216413.html
    – derobert
    Dec 8 '21 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.