Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

when we read the ip address of the user using our website, which addresses will absolutely not turn up?

From this page:

class E ip addresses are Reserved for future use, or Research and Development Purposes.

I want to know when I get the ip address of the user (a normal non-hacking user) using my website (which is hosted over the net),

which ip address ranges will NEVER come up?

share|improve this question

migrated from Nov 10 '11 at 9:44

This question came from our site for professional and enthusiast programmers.

What's the purpose of this? Is it specifically to identify possible malicious requests? – Matt Peddlesden Nov 10 '11 at 9:49

The term is Bogon filtering

A bogon is a bogus IP address, and an informal name for an IP packet on the public Internet that claims to be from an area of the IP address space reserved, but not yet allocated or delegated by the Internet Assigned Numbers Authority (IANA) or a delegated Regional Internet Registry (RIR). The areas of unallocated address space are called the bogon space.

Bogons are not the same as reserved private address ranges, such as those in and, which are reserved for private networks.1

Many ISPs and end-user firewalls filter and block bogons, because they have no legitimate use, and usually are the result of accidental or malicious misconfiguration. Bogons can be filtered by using router ACLs, or by BGP blackholing.

share|improve this answer has some others. In particular:

  127.* - loopback
  10.* - Class A private
  172.16.* - 172.31.* - Class B private
  192.168.* - Class C private - Broadcast

I also believe you will never see class D addresses

However, this doesn't account for IPV6, which i'm not as familiar with

share|improve this answer
Well, just because it is private does not mean it will never show up. – wonk0 Jul 7 '11 at 6:44
fair point. If the site is hosted internally, any private address can show up, and if a (possibly malicious) user decides to hand craft packets, they can mess with the ip address and try to send whatever they want – Jim Deville Jul 7 '11 at 6:46
that's the whole point. if someone tries to craft ip which are supposed to be "reserved", then i will know straight away that the ip is crafted. hence this question – KJelly Jul 7 '11 at 7:40
doesn't seem like that would help much given a user could still craft the packet to use a public ip instead of a known private ip – Jim Deville Jul 7 '11 at 7:43
well, someone altering his IP address will rather use a ordinary IP which will not raise suspicion. I don't think (s)he would use e.g. in that case – wonk0 Jul 7 '11 at 7:43

Security angle:

The best assumption is that attackers could spoof any address, so you should blanket filter all the ones that should never come in through your perimeter. This would include the ones in James and Steve's answers, plus any others you can guarantee should never hit your outside interface.

Don't just assume they would require a valid address so they can receive response packets - they may not need to, depending on the type of attack.

share|improve this answer
Absolutely. Syn-flood attacks, for example, purposely don't want to receive a response. That's part of how the attack works – Jim Deville Nov 18 '11 at 22:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.