What is a bogon?

A bogon refers to an Internet Protocol (IP) address that is not legitimately recognized, as it has not been officially allocated to any organization by an Internet registration authority like the Internet Assigned Numbers Authority (IANA). 

The emergence of bogons is typically due to incorrect configurations or deliberate misuse, creating ambiguity about the true origin of the IP address. The term 'bogon' itself is derived from the slang word 'bogus,' indicating its illegitimate nature.

What is a bogon address?

Bogon IP addresses are those not allocated to any organization by authorities such as the IANA or Regional Internet Registries (RIRs). These unassigned IPs form what is known as the 'bogus space.' Additionally, bogons encompass certain reserved private addresses and link-local address ranges, often referred to as 'Martian Packets.' Over time, IANA or an RIR might allocate these bogon IP addresses, changing their status.

Keep in mind that Bogon and Martian addresses are not the same thing. Bogon addresses include unallocated IP address spaces, while Martian addresses are reserved IPs for special-use purposes and are not meant to be routable on the public internet. Martian addresses cover ranges like loopback addresses and private IPv4 address spaces such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.  

As bogon IP addresses do not correspond to any specific internet user or server, they cannot be geolocated. As a result, geolocation applications typically do not return location data for bogon range IPs but may indicate their bogon status.

How does a bogon work?

IP addresses serve as unique identifiers for websites and servers. These addresses are allocated by IANA or other regional internet registries and are essential for communication between different network points.

The collection of officially registered IP addresses constitutes the reserved space. An IP address is identified as a bogon when it doesn't belong to this reserved space or is part of the unassigned 'bogon space.'

An IP address's classification as a bogon can be temporary. With the dynamic nature of the IANA registry continually updating and assigning new IP spaces, what is considered a bogon today may become a legitimate address in the future. For example, the address range in 49.0.0.0/8 was unallocated before August 2010 but is now assigned by APNIC (Asia Pacific Network Information Centre), the RIR for the Asia-Pacific region. 

Updates on new assignments are frequently shared on network operators' mailing lists like NANOG to inform them about the legitimacy of previously bogon IP addresses.

Risks & prevention of bogons

Bogons, typically invisible over a network, are susceptible to misuse. Cybercriminals, such as hackers or spammers, often exploit bogons, particularly in distributed denial-of-service (DDoS) attacks, since bogon packets cannot be traced back to a real source. 

Additionally, these packets can be used to conduct TCP SYN scanning attacks or to transmit harmful data stealthily. Although routers are designed to avoid bogons in routing tables, they generally only scrutinize the destination IP address, not the source, leading to the forwarding of bogon packets.

To mitigate the risks posed by bogons, many internet service providers (ISPs) employ bogon filtering. This process involves setting up access control lists or Border Gateway Protocol (BGP) blocklists on devices. Lists of current bogons are accessible through various channels, including routing registries, the Hypertext Transfer Protocol, domain name systems, and BGP peering.

When a bogon becomes a legitimate address, it is often announced on network operators' mailing lists. This enables organizations to update their filters accordingly. Additionally, software tools that dynamically manage the blocking and unblocking of bogons on network devices are available and can be a useful resource for organizations seeking to enhance their network security.

Bogon filtering and blacklists

Bogon filtering helps secure networks from unwanted traffic associated with unallocated or reserved IP address ranges. Internet service providers (ISPs) and network administrators typically use bogon filters to block incoming traffic from these illegitimate IP addresses, which are often exploited in cyberattacks such as DDoS or IP spoofing.

There are several tools available for bogon filtering, including access control lists (ACLs) and Border Gateway Protocol (BGP) blocklists. These filters drop traffic from unallocated IP ranges (bogons) before it reaches its destination. ISPs often update their bogon filters as new IP address ranges are allocated by organizations like IANA.

In practice, filtering mechanisms like DNS-based blacklists (DNSBLs) are used to flag bogon IPs and stop them from entering a network. These blacklists help to track unallocated IP addresses, making them useful for both email servers and routing protocols. DNSBLs not only filter spam but also provide real-time updates on IPs that need to be blocked to protect networks.

IPv4 bogon ranges

The Internet Protocol version 4 (IPv4) serves as a protocol designed for packet-switched networks at the Link Layer level, such as Ethernet.

‍

IPv6 bogon ranges

According to Linksys, the main difference between IPv4 and IPv6 is the appearance of the IP addresses: 

• IPv4 uses four 1-byte decimal numbers, separated by a dot. For example, 192.168.1.1 
• IPv6 uses hexadecimal numbers that are separated by colons. For example, fe80::d4a8:6435:d2d8:d9f3b11

‍

Additional bogon ranges

These ranges do not officially constitute IPv6 bogon ranges; instead, they represent IPv6 versions of various IPv4 bogon ranges.

‍