177

It's very bad. Here is a list of examples of what I have first hand experience with consumer ISPs doing to fight the shortage of IPv4 addresses: Repeatedly shuffling around IPv4 blocks between cities causing brief outages and connection resets for customers. Shortening DHCP lease times from days to minutes. Allow users to choose if they want network address ...


135

Before we started to run out of IPv4 addresses, we didn't (widely) use NAT. Every internet connected computer would have its own globally unique address. When NAT was first introduced, it was to move from giving ISP's customers 1 real address per device the customer used/owned to giving 1 customer 1 real address. That fixed the problem for a while (years) ...


104

These are dynamically configured link-local addresses. They are only valid on a single network segment and are not to be routed. Of particular note, 169.254.169.254 is used in Amazon EC2 and other cloud computing platforms to distribute metadata to cloud instances.


99

To block 116.10.191.* addresses: $ sudo iptables -A INPUT -s 116.10.191.0/24 -j DROP To block 116.10.*.* addresses: $ sudo iptables -A INPUT -s 116.10.0.0/16 -j DROP To block 116.*.*.* addresses: $ sudo iptables -A INPUT -s 116.0.0.0/8 -j DROP But be careful what you block using this method. You don't want to prevent legitmate traffic from reaching the ...


92

The whole idea behind the MX record is to specify a host or hosts which can accept mail for a domain. As specified in RFC 1035, the MX record contains a domain name. It must therefore point to a host which itself can be resolved in the DNS. An IP address could not be used as it would be interpreted as an unqualified domain name, which cannot be resolved. ...


41

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it. Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the hostname gets displayed and long ones get truncated to display nice columns. Try last -a to display the hostname on the last column without truncation. or ...


29

DNS Names are resolved when the rules are added, not, when packets are checked. This violates the expectations most people have. The rule does not get updated to reflect changed DNS results. It is resolved when added and that is it. You will need to either periodically reload rules, or some sites may break. There is a bit of a security issue in that you ...


29

Is that how IPv6 is intended to work? In short, yes. One of the primary reasons for increasing the address space so drastically with IPv6 is to get rid of band-aid technologies like NAT and make network routing simpler. But don't confuse the concept of a public address and a publicly accessible host. There will still be "internal" servers that are not ...


28

Unless the ISPs share netblocks (very unlikely), this is not a realistic outcome. If you're looking to keep the static IP for DNS reasons, you should instead lower your TTLs and keep both ISPs (and by extension, IP addresses) until you can gracefully migrate.


25

As stated in other answers, having too many hosts in the broadcast domain can really start to make broadcasts a mess. They'll need a lot of expansion in the subnet before it becomes a potential problem. Future growth planning becomes a mess. Adding extra sites with their own IP space gets difficult when you've already laid a needlessly huge footprint down ...


25

Roughly this: Become a LIR (Local Internet Registry) Obtain and set up your AS (Autonomous System) Decide what address you'd like to use (e.g. 7.7.7.7) Find out who currently has it assigned: whois 7.7.7.7. Ok, it's US army, try a different one: whois 77.77.77.77 - cool someone from Iran. Contact them and offer them loads of money for transferring the 77.77....


22

Unless you own the IP address block it's in, and it's in Provider Independent (PI) Space, then you might be able to switch transit providers, and announce your routes over your new BGP sessions with your new ISP, then it might be possible. Given the lack of networking knowledge show in the OP's question, these assumptions seem unlikely.


21

One big symptom of IPv4 exhaustion I didn't see mentioned in other answers is that some mobile service providers started going IPv6-only several years ago. There's a chance you've been using IPv6 for years and didn't even know it. Mobile providers are newer to the Internet game, and don't necessarily have huge pre-existing IPv4 allocations to draw from. ...


20

We use public IPv6 addresses in our company network for all devices. We use a stateful firewall on our gateway, that: allows all icmpv6 allows new connections from internal network out allows established connections from public to internal No public traffic (except ICMP and established connections) should get into our network. So far we had no problems ...


19

The main reason is that stateless address autoconfiguration as per RFC4862 requires a /64 network to work properly. Add to that the assumption that one will want more than a single subnet at one's installation and the difficulty of routing arbitrary multiples of a /64, and the automatic tendency seems to be to assign a /56, or if lazy, a /48. Oddly, I'm ...


19

DNS as a protocol has some different types of values, these are not interchangable. It's important to note that DNS is a binary protocol with strict mappings between the type of record and the type of data that such a record holds. For example: An A record holds an IPv4 address (4 bytes of data, fixed length). An AAAArecord holds an IPv6 address (16 bytes ...


16

There are multiple reasons to do so. Your University is probably running this network since back in the days when there were no subnet masks and the private 192.168.x networks were Class C networks, limited to 255 machines. 172.x were Class B networks with up to 65535 addresses. More important, if you want to allow VPN access to a network from people's home ...


15

Determine the IP address that is assigned to your server and then go onto the DHCP and set a DHCP reservation for that server.


14

In almost all circumstances that's a IP assigned automatically by an interface that's set to get its IP via DHCP but can't get one.


14

If there is no need for outside connectivity, then private networks can be used. That is the reason for defining private address space also in IPv6. NAT is a hack that was invented to delay IPv4 address space exhaustion. NAT causes issues with applications, and to get the applications to work with NAT, more hacks are needed which conflict with the original ...


14

The major RIRs ran out of space for normal allocations a while ago. For most providers therefore the only sources of IPv4 addresses are their own stockpiles and the markets. There are scenarios in which it is preferable to have a dedicated public IPv4 IP but it's not absolutely essential. There are also a bunch of public IPv4 addresses that are allocated ...


13

Using nmap a lot of info can be found.. nmap -A -v -v 192.168.1.0/24 gives a lot of information, even SO in some cases nmap -sn 192.168.1.0/24 gives the MAC and IP addresses. Very Useful too sudo nmap -PU 192.168.1.0/24 explains every IP address


12

route -n get www.yahoo.com I am running os x 10.6.8


12

All of 0.0.0.0/8 is reserved, so that definitely isn't a valid IP for an ntp server. You can check the IANA registry for more information. You should file a few bug reports. One against pool.ntp.org, because they should be verifying the validity of IP addresses before allowing them into the pool. And one against check_ntp_time, because it shouldn't die even ...


11

Answer: yes. Your browser will still promptly engage in the three-way TCP handshake with the server at ###.###.###.###, and your ISP can see that. Once the connection's set up, your browser will have an SSL handshake with the server, and your ISP can see that. Once session keys have been negotiated, your browser will continue to exchange SSL-encrypted ...


11

It's a IPv4 link local address, as defined in rfc3927. Usually ZeroConfig/Bonjour/mdns et al enabled boxes are setup to have IPv4 ll address to enable (home) networking without the presence of an DHCP or unicast DNS server.


11

sudo /sbin/iptables -A INPUT -s 116.10.191.0/24 -j DROP This blocks the range. You can expand the subnet as needed with the same general format.


10

proxy_bind directive allows you to choose different source IP address. http://wiki.nginx.org/HttpProxyModule#proxy_bind So your configuration would look like: proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; location /integracao/ {...


10

If you use hostnames in your firewall, your firewall is now dependent on DNS. This opens the firewall to a number of issues: DNS lookups under high volumes could cause latency. DNS changes do not propagate instantly. So your firewall could be using cached IPs. DNS can be spoofed, hijacked, hacked. DNS can fail - meaning your firewall fails. Your ...


10

Move your servers to a separate VLAN - this will mitigate although there is nothing preventing the user from setting his IP to that of the gateway. Or better, move the problem user to his own VLAN. This can also be solved by using dynamic arp inspection on a good enough managed switch. This can also be solved by treating it as a disciplinary problem that ...


Only top voted, non community-wiki answers of a minimum length are eligible