The networks using these officially unallocated addresses are intended to be private, not visible to the global Internet. Nonetheless, their use can be detected when the private parts of networks connect to their public Internet facing connections, such as the connections to their service providers. The addresses leak in e-mail message headers, DNS queries and other random traffic. In some cases, this unofficial use can cause operational problems.

IANA staff has tried to research which /8s are being used in this way. In 2008 we sponsored research by Duane Wessels into which /8s see the most use. He reported on his research at OARC’s DNS Ops meeting and I wrote about it on this blog. Based on this work, we think the /8s with the most unofficial use are:

1, 2, 5, 14, 23, 39, 42, 100, 101, 107, 175 and 176

Duane Wessels’ research was part of a number of presentations that were part of an awareness campaign we worked on. This included talks at network operator groups and articles in industry journals and in some cases discussions with the users of the unallocated space where we could identify them. While we have discussed the issue with some of these network operators, we haven’t been able to speak directly to everyone making unofficial use of this address space because they tend to do so in private networks.

We know that newly allocated IPv4 /8s can be difficult for assigned users to use at first because old filters which block unallocated addresses are slow to be updated with new allocation information. There might be some extra operational difficulties with these particular /8s if unofficial users of the addresses try to communicate with the newly assigned official users of the same addresses.

The longer-term solution to this problem is for network operators to switch to IPv6 and to stop using the unallocated blocks entirely.

Over the next two years we will continue to allocate from these /8s when making allocations to the RIRs. The RIRs use about one /8 per month and so over the next couple of years we know that all of these /8s will be allocated.

Mexico City is no exception. Although this time, it is very much easier to get a quick overview of what is out for public comment by looking at the front page of the ICANN website (the third box down on the right).

Just to present you with another avenue to finding out about these public comment periods, there are all listed below with quick explanations of what they are and the dates when they close.

Open comment periods

1. GNSO Constituency Renewals. Closes 25 FEB
As part of the ongoing changes to ICANN’s main policy-making body, the GNSO, all the existing constituencies have put in submissions stating that they have followed the bylaws and so should be reconfirmed as valid constituencies. You are free to comment on these submissions.

2. IPv4 Global Policy. Closes 26 FEB
We are running out of IPv4 address space and so ICANN has been working with the Regional Internet Registries (RIRs) to decide what system we follow as the addresses get more and more scarce. The policy here proposes that each RIR be allocated one “slash-8″ – equating to roughly 16.7 million IP addresses – as soon as they are only five blocks left. If you have a comment on this you can make it between now and 26 February.

3. Single and Two-Character .BIZ Domains. Closes 15 MAR
The company that runs the .biz registry, NeuStar, wants to make single and two-character domains available. Until recently, no registries were allowed to do this because of technical concerns. But those rules have relaxed over the past year or so. To be allowed to create, for example, i.biz, NeuStar has to change its contract with ICANN, and ICANN puts all contract changes out for public comment and review. So if you have an opinion about this, you can make it online.

4. Geographic Regions Working Group Charter. Closes 24 MAR
As an organization hoping to represent global stakeholders, ICANN has followed the common approach of splitting the world up into different regions in order to make things manageable. The problems is: where do you draw the lines? It may seem simple but the closer the issue is looked at, the more complex it becomes. So, in order to review what these regions are and who they include, ICANN has created a Working Group to go through all the issues and make recommendations at the end of it. The first step in that process is to create a charter for the group – outlining the scope and methodology that will be followed. This public comment period opens that charter up to public review.

5. Fast Track Proposed Solutions. Closes 6 APR
The Fast Track is the process by which governments and the managers of different countries’ registries will be able to apply for and receive versions of their country name in different languages scripts at the top-level of the Internet i.e. the part after the dot in a domain name. An example would be “China” in Chinese characters. These “internationalized domain names” or IDNs are being put out on the Internet for the first time as the technical issues that make it possible have only recently been resolved.

It is not a simple process by any means, so ICANN has been producing drafts of an “implementation plan” to make this process a reality. In this iteration, as well as the latest version of the Fast Track Implementation Plan, there will be three papers identifying specific issues that still need to be resolved. You can see all the papers in question and make comments about them now and until 6 April.

6. ALAC Review Final Report. Closes 17 APR
ICANN regularly reviews of its main supporting organizations and advisory committees to make sure they remain relevant and in the correct format. The At Large Advisory Committee or ALAC exists to represent ordinary Internet users and it has been under review for roughly a year and the process is drawing to a close. A final report of the working group created to carry out much of the review has been released for its final piece of public comment before being formally submitted to a Board Committee that then puts it forward to a vote by the whole Board. So if you want your say on how ordinary Internet users should be represented within the ICANN model, this is your last chance. Until the ALAC is reviewed again in a few years.

7. Operating Plan and Budget FY2010. Closes 30 APR
People are constantly asking how much money ICANN has and how it decides where to spend it. What few people recognise however is that those decisions are heavily influenced by the community itself. Every year, ICANN runs through a public strategic planning process that outlines what the organization needs to do in the next year. It then turns that into an Operating Plan and from that devises its budget. The community is invited every year to provide their feedback on the process of where ICANN spends it money. This is a comment period on the first version of the Operating Plan and Budget for ICANN’s 2010 financial year. The comments from this will be used to revise the plan and budget and it will then be put out a second time before being approved by the Board in June.

And that’s it for now. Much of the community will be focussed on the revised Applicant Guidebook for new generic top-level domains that will come out in the next day or so, but please do not forget these other public comment periods.

You can view all open and recently closed public comment periods on one page, as well as an archive of older comment periods: http://www.icann.org/en/public-comment/.

So where is IPv6 deployment most evident? It?s a very difficult thing to measure. It is difficult to measure the amount of IPv6 traffic as so much of it is tunneled inside of IPv4. And anyway, tunneled traffic is probably from end users rather than ISPs, but we need ISPs to deploy IPv6 to allow the Internet to grow. So how can we see where ISPs are deploying IPv6 in their networks?

One possible measure of IPv6 deployment in ISPs is the number of IPv6 address blocks (prefixes) seen in the routing table in comparison with the the number of autonomous systems (ASs – roughly equivalent to ISPs) in a region. Geoff Huston has a regional breakdown of advertised ASs on his web site and the SixXS project has a regional breakdown of the IPv6 address blocks visible per region on its web site.

AfriNIC, the Regional Internet Registry for Africa and parts of the Indian Ocean, has a higher proportion of networks in its region announcing IPv6 addresses than the others. Africa also has a smaller deployed base but IPv6’s size is designed to support exactly the kind of network growth that highly populated areas, like Africa and Asia will see as their deployed base grows in the next few years.

Proportion of ASs in RIPE NCC service region announcing IPv6 prefixes

Proportion of ASs in APNIC service region announcing IPv6 prefixes

Proportion of ASs in ARIN service region announcing IPv6 prefixes

Proportion of ASs in LACNIC service region announcing IPv6 prefixes

Proportion of ASs in AfriNIC service region announcing IPv6 prefixes

The event in Seoul was the largest gathering to date with more than 68 participants representing 26 registrars and six registries. And, of the 56 registrar participants, 54% reported that they had not previously attended an ICANN meeting. Also, for the first time since the inception of the gatherings, presentation materials were provided in Chinese, Japanese and Korean. Additionally, clean and red-lined versions of the RAA and proposed changes were provided in the same languages.

Topics presented at the gathering included a summary of the outcomes of the recent Paris meeting, proposed amendments to the RAA, protection of registrants (registrar data escrow/interim terminated registrar transition plan and registry failover), IDNs, new gTLDs, compliance/UDRP, GNSO policy items, IPv4/IPv6, and recent Board actions around the Add Grace Period (AGP).

The event was supported through generous contributions from DotAsia, Afilias and NeuStar.

For further information about this event, please contact Craig Schwartz or Tim Cole.

Duane Wessels of The Measurement Factory analysed DNS queries for evidence of how unallocated IPv4 addresses are being used and presented them at the last OARC meeting, last month. The results cannot give a complete view of what is happening, as it does not see what is happening in private, behind closed firewalls. Nonetheless, these are useful data.

We will be using these data to help plan for the last few IPv4 allocations to the RIRs.

My landlord isn’t the only ISP providing an Internet connection using private IPv4 addresses. As mentioned at the last AfriNIC meeting, there are many millions of connections sitting behind hierarchies of IPv4 NATs.

But this week I was inspired to look at deploying IPv6 alongside my NAT. This has been done very successfully in the IPv6 hours at NANOG 42, APRICOT 2008 and this week’s IETF 71. I wanted to see if I could get IPv6 connectivity to my laptop despite not having a unique address to terminate a tunnel. I did and it took me less than five minutes.

If your ISP doesn’t provide a native IPv6 service you can get an IPv6 tunnel from an ISP that provides IPv6 tunnels. An IPv6 tunnel is just a way of putting IPv6 packets inside IPv4 packets for the IPv4 portion of the journey over the Internet. I can’t use the popular 6to4 tunnelling method because they can only run between two hosts with unique addresses and I don’t have a unique address on my home network.

Fortunately, Teredo (also known as Miredo) lets me tunnel IPv6 packets past my NAT, giving me what the IETF have called “IPv6 access of last resort”. Windows Vista computers have Teredo support built in but my OS X machine does not. But just 30 seconds with a search engine showed me that “deep darc” has published an implementation of Miredo for OS X. In less than a minute it was downloaded and installed.

There was no need to change any of the settings because the defaults worked fine. On visiting the IANA web site I saw that my browser was using IPv6 (see image at the top).

Teredo/Miredo will give the users of NATed connections access to unique IPv6 addresses, making it easier for them to use any services blocked by NATs in their ISP’s network.

We made other changes, too. The IPv4 registry used to report that a lot of /8s were allocated to “Various Registries”. That wasn’t very helpful to anyone; it was a bit like saying “we don’t know”. In fact, the RIRs have been providing DNS and Whois services for addresses in these /8s but the IANA IPv4 registry didn’t indicate which RIR to consult because addresses in each of these /8s are often used by organisations in different RIR regions.

The RIRs and ICANN staff worked together to provide a more useful registry. Each of these /8s is now shown as “Administered by” one RIR. That RIR manages the reverse DNS for the /8 and provides a Whois service with a referral to the appropriate RIR when necessary.

We hope it’s much more useful and transparent than before.

With help from the Regional Internet Registries, three /8s were returned in 2007 and last month we recovered one more. We now have 43 unallocated /8s. Here’s a table showing the details of the returned blocks.

/8	Year	Help from
46 – BBN	2007	BBN and ARIN
49 – US DoD	2007	ARIN
50 – US DoD	2007	ARIN
14 – Public Data Net	2008	Network Operators

Despite this windfall we are unlikely to see any more whole /8s returned to the IANA free pool. Our investigations indicate that the other legacy “Class A” assignments are all at least partially used. Recovering the space in those blocks would require large companies to engage in expensive renumbering exercises.

But more importantly, it would not buy us very much time. We allocated more than one /8 per month in 2007, so to gain even one year would require a huge amount of renumbering by the users of more than a dozen legacy assignments.

Geoff Huston’s mathematical projection suggests the IANA free pool will be empty before the second half of 2011 and the RIRs’ pools will run out barely a year later. Of course, whatever mathematical models he uses, he cannot account for the very human possibility of a run on the bank.

Address recovery cannot extend the life of the IANA free pool by more than a few months.

It is possible that unused portions of the legacy “Class A” and “Class B” will be returned to the RIRs free pools. Alternatively, it is possible people with partially used legacy assignments will wait for a variant on the policy proposals in the RIPE and APNIC communities to emerge and then engage in remunerated renumbering and address transfer programs.

Whatever actually happens in the next few years, we can be sure that anyone needing large amounts of address space for a rapidly growing network will have to deploy IPv6. IPv6 deployment in the Internet’s core infrastructure is continuing and network operators at ISPs and enterprises need to plan for a world where their users will need to communicate with systems on both IPv4 and IPv6.