Aliens Among Us: Observing Private or Reserved IPs on the Public Internet

Aliens Among Us: Observing Private or Reserved IPs on the Public Internet

Speakers: Radu Anghel

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=nj5tNaEYhLI

Overview

IP address spoofing remains a fundamental enabler of volumetric DDoS attacks, with nearly half of layer 3/4 attacks involving spoofed packets. While Source Address Validation (SAV) can solve this problem, deployment remains incomplete. This talk introduces a novel passive measurement methodology using CAIDA's Ark traceroute dataset to detect bogon packets -- packets with private, reserved, or unallocated IP source addresses -- traversing the public internet. Analyzing eight years of data (2017-2024) covering 11 million traceroutes, the researchers find that 20% of all visible autonomous systems have exhibited at least one bogon, the number is slightly increasing over time, and even networks that have pledged to implement anti-spoofing best practices through MANRS still show bogon traffic.

The findings challenge the assumption that bogons are merely benign misconfigurations, suggesting they can serve as indicators of missing source address validation and potential infrastructure for spoofed DDoS attacks.

Background

▶ Watch: DDoS trends: spoofed packets play increasing role in attacks (0:00)

DDoS attacks continue to increase in both frequency and volume. Cloudflare's 2024 threat reports show that almost half of attacks are layer 3/4, which can involve spoofed source addresses. Akamai reports that one-third of global DDoS attacks in certain regions use spoofed DNS queries as the primary vector. The solution -- Source Address Validation (SAV) -- has been known for decades, but many networks still don't properly implement it.

Active measurement approaches like CAIDA's Spoofer project (started by Robert Beverly in 2005 in San Diego) actively probe networks to determine if they allow spoofing. However, this relies on volunteers running code locally, limiting coverage. The key idea of this paper is to instead look passively at internet traffic for packets that should not exist -- bogons -- and infer from their presence that networks lack proper source address validation.

Martians are packets with source addresses that forwarding tables would not route return traffic to. Bogons are packets with IP source addresses that neither IANA nor the RIRs have allocated -- addresses reserved for private use (RFC 1918), link-local, class E, and other special-purpose ranges. In network operations practice, the terms are often used interchangeably, and both are common sources of spoofed packets.

Key Findings

▶ Watch: CAIDA Ark dataset: 8 years, 11 million traceroutes (4:00)

• 20% of all visible autonomous systems showed at least one bogon over the eight-year study period -- more than 15,000 ASes
• Bogon prevalence is slightly increasing over time, a concerning trend from a security perspective
• Link-local bogons spiked around 2020-2021, and Class E bogons appeared sharply from 2021, suggesting these are linked to transient events or misconfigurations rather than constant background noise
• US, Brazil, and Russia lead in absolute numbers of ASes with bogons, correlating with their larger AS counts
• MANRS-conforming networks still have bogons: Even networks that joined MANRS (Mutually Agreed Norms for Routing Security) and specifically pledged anti-spoofing compliance still exhibit bogon traffic
• Spoofer vs. bogon mismatch: Over half of ASes that CAIDA's Spoofer project classified as "non-spoofable" still showed bogons -- meaning some operators implement SAV for external IP ranges but ignore certain bogon types
• ISPs are most affected: Categorization using ASDB shows that ISPs account for the majority of ASes with bogons, which makes sense given their more complex network configurations
• IPv4 exhaustion hypothesis: The researchers hypothesize that increasing IPv4 address scarcity may be driving more private IP space usage without proper router configuration, contributing to bogon leakage

Technical Deep Dive

▶ Watch: Link-local and Class E bogon spikes reveal transient events (8:00)

The study uses CAIDA's Ark (Archipelago) project, which runs traceroutes through all routed /24 IPv4 address space daily. The researchers analyzed eight years of data (2017-2024), collecting 11 million traceroutes. Due to measurement consistency issues (some days lack complete data because prior measurements are still running), the researchers selected day 18 of each month across all eight years as the most consistent measurement day.

The researchers focused on eight categories of bogon addresses defined by various RFCs: private use (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local, class E, and other reserved ranges. These addresses should never appear as source addresses in packets crossing autonomous system borders.

The key research questions are: (1) Does observing a bogon crossing an AS border indicate missing SAV? (2) How can bogons be detected in the wild? (3) Are bogons merely benign misconfigurations, or do they have security implications?

The comparison with CAIDA's Spoofer project reveals an important nuance: the two measurements capture different aspects of SAV deployment. Spoofer tests whether a network filters outbound spoofed packets with arbitrary source addresses. Bogon detection reveals whether specific reserved address ranges are filtered. The mismatch (networks passing Spoofer tests but exhibiting bogons) shows that some operators implement SAV for external address ranges but create exceptions for certain bogon categories.

The MANRS analysis adds another dimension: networks that have formally committed to anti-spoofing best practices still show bogon traffic, even those that joined MANRS at least one year before the measurements.

Demo / Proof of Concept

▶ Watch: MANRS members still have bogons despite anti-spoofing pledges (10:00)

The analysis spans a comprehensive eight-year dataset providing longitudinal insight into bogon prevalence trends. Key visualizations include:

• Time-series plots showing bogon prevalence by type across 2017-2024, revealing both stable background levels and transient spikes
• Country-level distribution maps correlating bogon prevalence with AS density
• Cross-reference analysis between CAIDA Spoofer classifications and bogon observations
• MANRS membership analysis comparing conforming versus non-conforming networks
• AS category breakdown using ASDB showing ISP dominance in bogon-exhibiting networks

The methodology has acknowledged limitations: Ark traceroutes run only once daily (missing sub-daily transient bogons), some measurement days are incomplete, and path asymmetry in traceroutes introduces potential measurement artifacts. The researchers leave methodology improvement and operator surveys for future work.

Defensive Implications

▶ Watch: Q&A: DoD address space abuse and ICMP filtering exceptions (14:00)

The research has several practical implications for network security operations:

• Passive SAV auditing: Organizations can use bogon detection in traceroute data as a complementary method to active Spoofer probing for assessing SAV deployment, especially in networks where volunteer participation is unavailable
• Attacker infrastructure selection: An attacker could use this methodology to identify networks that allow spoofing, choosing where to place compromised machines or attacking infrastructure for maximum spoofing capability
• MANRS accountability: The finding that MANRS-conforming networks still exhibit bogons suggests that self-certification of best practices needs independent verification mechanisms
• Selective SAV gaps: The mismatch between Spoofer results and bogon observations reveals that many networks implement SAV partially, filtering arbitrary spoofed addresses but creating exceptions for bogon ranges -- a security gap that attackers could exploit
• BGP security context: Bogon filtering is a foundational layer of routing security. Networks that fail to filter bogons likely have other routing security gaps that could be exploited for BGP hijacking or traffic interception

Key Takeaways

• 20% of all visible autonomous systems exhibited at least one bogon packet over eight years of traceroute data, and the trend is slightly increasing
• Even MANRS-conforming networks that pledged anti-spoofing compliance still show bogon traffic, indicating self-certification gaps
• Networks classified as "non-spoofable" by CAIDA's Spoofer project may still leak bogons, revealing selective SAV implementation
• ISPs are disproportionately affected due to their more complex routing configurations
• IPv4 address exhaustion may be driving increased private IP space usage without proper router reconfiguration
• Bogon detection provides a passive alternative to volunteer-dependent active probing for assessing SAV deployment

About the Speaker(s)

The presentation was delivered by Carlos Janyan from ICANN on behalf of the lead author Radu Anghel, a PhD candidate at Delft University of Technology (expected to finish this year). The collaboration includes Juris Sharovich from Delft, RIPE NCC (the European RIR), and Matthew Yulaki from CAIDA at UC San Diego. The cross-organizational collaboration between ICANN, a university, a RIR, and a network measurement organization brings unique perspective to the routing security problem.