RFC 6441

Time to Remove Filters for Previously Unallocated IPv4 /8s

📅 published November 2011, from ietf

RFC 6441 ✨ Time to Remove Filters for Previously Unallocated IPv4 /8s

Okay bestie, this is RFC 6441 💖, a Best Current Practice (that makes it BCP 171 🎀). It was written by Leo Vegoda from ICANN and published in November 2011. It's an IETF document, with ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so there's nothing to chase there 🌸

Abstract 🦋

For ages, network admins filtered IP traffic and BGP prefixes coming from unallocated IPv4 address space. But now there are no unallocated IPv4 /8s left, so this whole practise is more complicated, fragile, and expensive 💀 Admins are told to remove the filters that depend on the registration status of the address space.

This doc explains why any leftover packet and BGP prefix filters for unallocated IPv4 /8s should be removed from border routers, and it lists the IPv4 unicast prefixes that should not be routed across the public Internet 🧚

Status of This Memo 📜

This memo documents an Internet Best Current Practice.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). More info on BCPs is in Section 2 of RFC 5741.

For the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc6441 🔥

Copyright Notice ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as in effect on the date this document was published. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 🫶

Table of Contents 🗺️

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 2
3.  Traffic Filtering Options . . . . . . . . . . . . . . . . . . . 3
  3.1.  No Longer Filtering Based on Address Registration
        Status  . . . . . . . . . . . . . . . . . . . . . . . . . . 3
  3.2.  Continuing to Filter Traffic from Unallocated IPv4
        Space . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
4.  Prefixes That Should Not be Routed across the Internet  . . . . 3
5.  Security Considerations . . . . . . . . . . . . . . . . . . . . 3
6.  References  . . . . . . . . . . . . . . . . . . . . . . . . . . 4
  6.1.  Normative References  . . . . . . . . . . . . . . . . . . . 4
  6.2.  Informative References  . . . . . . . . . . . . . . . . . . 4
Appendix A.  Acknowledgments  . . . . . . . . . . . . . . . . . . . 5

1. Introduction 🌈

For ages, network admins filtered IP traffic and BGP prefixes coming from unallocated IPv4 address space. Now that there are no unallocated IPv4 /8s left, this practise is more complicated, fragile, and expensive 😭 Admins are told to remove filters that are based on the registration status of the address space.

This doc explains why any remaining packet and BGP prefix filters for unallocated IPv4 /8s should be removed from border routers, and it documents the IPv4 unicast prefixes that should not be routed across the public Internet ✨

2. Terminology 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119].

Martians [RFC1208] is a funny term for packets that show up unexpectedly on the wrong network because of bogus routing entries 👽 It's also a name for a packet with a totally bogus (non-registered or ill-formed) Internet address. Bogons [RFC3871] are packets sourced from addresses that IANA or the Regional Internet Registries (RIRs) haven't allocated yet, or addresses reserved for private or special use by RFCs [RFC5735]. Some people call bogons "Dark IP" 🖤

3. Traffic Filtering Options 💅

3.1. No Longer Filtering Based on Address Registration Status 💀

Network admins who set up filters for unallocated IPv4 /8s did it knowing those /8s weren't a legit source of Internet traffic, and that there were only a few bogon filters to set up. But now there are no unallocated unicast IPv4 /8s left, so legit Internet traffic will come from every unicast /8 that isn't reserved for special purposes in an RFC 🫠

Removing packet and prefix filters based on the registration status of the IPv4 address is a simple move that stops legit traffic from getting blocked 🙌 Network operators SHOULD remove both ingress and egress packet filters, as well as BGP prefix filters, for previously unallocated IPv4 /8s.

3.2. Continuing to Filter Traffic from Unallocated IPv4 Space 🔍

Some admins might still want to filter unallocated IPv4 addresses managed by the RIRs. That takes way more granular ingress filters, and since the RIRs' address pools change so much, the filters need updating on a daily basis so they don't block legit incoming traffic 😵‍💫

4. Prefixes That Should Not be Routed across the Internet 🚫

Network operators may deploy filters that block traffic headed to Martian prefixes. Right now the Martian prefix table is defined by [RFC5735], which reserves each Martian prefix for some specific, special use. If that table ever changes, the change will be documented in an RFC that either updates or obsoletes [RFC5735] 📝

5. Security Considerations 🔐

Getting rid of filters based on unallocated IPv4 /8 allocations is an evolutionary step toward reasonable security filters. These filters aren't needed anymore, and in fact they're harmful, but that doesn't mean we can skip other security solutions. Those other solutions are just as necessary today as they ever were 🚨 Do not drop your guard, bestie 🫶

6. References 📚

6.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC5735]  Cotton, M. and L. Vegoda, "Special Use IPv4 Addresses",
           BCP 153, RFC 5735, January 2010.

6.2. Informative References

[RFC1208]  Jacobsen, O. and D. Lynch, "Glossary of networking terms",
           RFC 1208, March 1991.

[RFC3871]  Jones, G., "Operational Security Requirements for Large
           Internet Service Provider (ISP) IP Network
           Infrastructure", RFC 3871, September 2004.

Appendix A. Acknowledgments 🎀

Huge thanks to Kim Davies, Terry Manderson, Dave Piscitello, and Joe Abley for helpful advice on how to focus this document 💜 Thanks also go to Andy Davidson, Philip Smith, and Rob Thomas for early reviews and suggestions that made the text better, and to Carlos Pignataro for his support and comments 🌸

Author's Address 📮

Leo Vegoda
Internet Corporation for Assigned Names and Numbers
4676 Admiralty Way, Suite 330
Marina del Rey, CA  90292
United States of America

Phone: +1-310-823-9358
EMail: leo.vegoda@icann.org
URI:   http://www.iana.org/

📦 where this page comes from

ietf: rfc6441 2011-11
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms