Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

when we read the ip address of the user using our website, which addresses will absolutely not turn up?

From this page: http://www.computerhope.com/jargon/i/ip.htm

class E ip addresses are Reserved for future use, or Research and Development Purposes.

I want to know when I get the ip address of the user (a normal non-hacking user) using my website (which is hosted over the net),

which ip address ranges will NEVER come up?

share|improve this question

migrated from stackoverflow.com Nov 10 '11 at 9:44

This question came from our site for professional and enthusiast programmers.

    
What's the purpose of this? Is it specifically to identify possible malicious requests? –  Matt Peddlesden Nov 10 '11 at 9:49

3 Answers 3

The term is Bogon filtering

A bogon is a bogus IP address, and an informal name for an IP packet on the public Internet that claims to be from an area of the IP address space reserved, but not yet allocated or delegated by the Internet Assigned Numbers Authority (IANA) or a delegated Regional Internet Registry (RIR). The areas of unallocated address space are called the bogon space.

Bogons are not the same as reserved private address ranges, such as those in 10.0.0.0/8 and 192.168.0.0/16, which are reserved for private networks.1

Many ISPs and end-user firewalls filter and block bogons, because they have no legitimate use, and usually are the result of accidental or malicious misconfiguration. Bogons can be filtered by using router ACLs, or by BGP blackholing.

share|improve this answer

http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses has some others. In particular:

  127.* - loopback
  10.* - Class A private
  172.16.* - 172.31.* - Class B private
  192.168.* - Class C private
  255.255.255.255 - Broadcast

I also believe you will never see class D addresses

However, this doesn't account for IPV6, which i'm not as familiar with

share|improve this answer
    
Well, just because it is private does not mean it will never show up. –  wonk0 Jul 7 '11 at 6:44
    
fair point. If the site is hosted internally, any private address can show up, and if a (possibly malicious) user decides to hand craft packets, they can mess with the ip address and try to send whatever they want –  Jim Deville Jul 7 '11 at 6:46
    
that's the whole point. if someone tries to craft ip which are supposed to be "reserved", then i will know straight away that the ip is crafted. hence this question –  KJelly Jul 7 '11 at 7:40
    
doesn't seem like that would help much given a user could still craft the packet to use a public ip instead of a known private ip –  Jim Deville Jul 7 '11 at 7:43
    
well, someone altering his IP address will rather use a ordinary IP which will not raise suspicion. I don't think (s)he would use e.g. 127.0.0.1 in that case –  wonk0 Jul 7 '11 at 7:43

Security angle:

The best assumption is that attackers could spoof any address, so you should blanket filter all the ones that should never come in through your perimeter. This would include the ones in James and Steve's answers, plus any others you can guarantee should never hit your outside interface.

Don't just assume they would require a valid address so they can receive response packets - they may not need to, depending on the type of attack.

share|improve this answer
    
Absolutely. Syn-flood attacks, for example, purposely don't want to receive a response. That's part of how the attack works –  Jim Deville Nov 18 '11 at 22:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.