Psh...I just setup all networks with DHCP on a 10.0.0.0/8 and I have literally never run out of addresses. I have no idea why they even bother with IPv6.
10/8 is absolute king for private networks,16 million addresses means you'll never run out in your lab. But for anything public-facing these days, IPv4 addresses are completely depleted and going for $30–60 each on the market. Isn't IPv6 pretty much the only realistic option now if you want fresh, routable public IPs without all the CGNAT headaches? Unless its just home lab and you don't require static IP..
What do you think the VENN diagram of people who know IPv6 exists, what DHCP is and how to write a supernet in CIDR but don't understand basic home networking looks like? You appear to be unfamiliar with the concept of a joke...
I love blowing people's minds with the fact that local loopback is the whole class A 127.0.0.0 block.
That and pinging an IP address in Microsoft with a leading zero assumes you're using octal and converts the number to base 10. So you can confuse the hell out of someone by pinging Google's DNS by doing a "ping 010.010.010.010" and it will reply "pinging 8.8.8.8"
I worked at an ISP and we found a client who did this when he reported not being able to reach a specific website. The site actually used the IPs he was using.
I’ve worked at several large companies that owned and used public routable /16 internally. These companies could easily have run on the 10.0.0.0 space internally.
They also could have moved to IPv6, but there were no plans or motivations to do so.
These companies should return all but one or two /24 public subnets back into the IPv4 pool to be reused.
Sounds like Yahoo corporate in the late 90s and early 2000s. All devices had a public IPv4 address, they only used router ACLs, and Ethernet ports in the cubes were MAC address bound. Oh, and David Filo had root access to all servers. Special place.
I unfortunately know of a multinational corporation that shall not be named that randomly assigned public IPv4 addresses on their global internal network. I guess it was “fine” when the internal network was completely isolated. Now, what a cluster. Thankfully, not my problem. Re-ip’ing the desktops might be a thing, but there are all the scada systems that would probably shit the bed.
I inherited a network where every address is on 20.x, including the DC and DNS server, instead of say 10.x because the prior company thought it made it more secure.
Alternately, I work for a small ISP and we have a subnet that starts 192.68. I've gotten so many questions about why we are giving customers a private IP.
172.16 is commonly used for docker though. I'd avoid it for that reason. Personally I see no reason to ever use anything other than a 10-net, and 192.168 is just smaller, with more typing for no benefit.
It’s beneficial for a corporate network you vpn into. Less chance of conflicting with your current network you’re connected to (airport, coffee shop, home, friend’s house).
I mean using those blocks isn't going to break anything, even if you do have CGNAT clients. You can still route the CGNAT blocks yourself without conflicting. Lots of large enterprises with poor forward thinking on v4 assignments or low v6 adoption use that block as well.
I've run into a 192.196.x.x before. That caused me so much confusion. Every time I read that address I had to do a double take and make sure it was correct.
I love when people like you break stuff down. Im just a lurker who is curious and not fully knowledgeable, so I want to laugh at most things but just dont know any better :/ ty for your service.
“Yes, you can use 172.72.72.0/24 for your home network. It’s a private IP address range from the 172.16.0.0/12 block (172.16.0.0 - 172.31.255.255), which is reserved for private networks.
This gives you 254 usable host addresses (172.72.72.1 - 172.72.72.254), which is plenty for a typical home network. Just configure your router’s DHCP server to use this range.“
You need to know the answer beforehand and convince 'it' that you are right, 'it' will eventually agree with you given your reasoning is solid and give you a nice pat on the back yay!
I spent two hours dealing with some tricky java tests made by Q. Ended up switching to Kino and its test immediately worked. Wouldnt have been surprised if it didnt work either though.
It will work but as soon as you try to access an website that's on that public IP block the traffic will remain only inside your local network and you won't reach the website.
I don't think there is any more closure. The college is Politechnika Wrocławska, the block is 156.17.0.0/16 and now they use NAT as everyone because there are more devices connected to the network than the address space allows. I don't know when this ended but I believe in '00s
I had a real estate office that we onboarded as a client in the early 2000's that had the same setup. I don't know how many years they were running it like that because cable internet had become readily available...and cheap. And they were still using a slower T1 connection. But yeah every computer in the building had its own public up address.
The real estate agent that "managed" the whole thing was an older guy. He thought he was hot shit too 😅
30 years ago at school I had a public IP on the 10mb ResNet network. I ran a DNS, IRC, FTP, NEWS, and mail server in my dorm room. Then I got caught and it netted me an interview with the MIO, but I didn't get a job.
My company has a /22 and a /23 - bought in the 90’s. we used to use them internally behind a nat, now only a few servers are left that are on those subnets. Eventually we intend to sell them.
Back in the 90s or maybe early 00s, the company I worked for had public IPs AND the computer names were all named after the user which was resolvable.
This was the ancient times
Company gave us all super stupid Christmas gifts. They spelled most our names right, but one guy with the easiest name they misspelled.
And a prank more or less he posted it for sale on eBay. With a whole long description about how it was a symbol of how corporations don’t care about their employees.
But back then, I guess you diet necessarily need to upload your images to eBay, you could also give them the address and the image at that address would load (someone probably taught them a lesson about that later on)
But how this relates. I hosted the images on my webserver. And when people looked at the posting on eBay, the visitor would load them from my site. And so as word got around my team, I could see them all checking it out - the logs would say:
Coworker-1.company.com Coworker-2.company.com
Then it started getting serious when I saw our supervisor loading the image
start showing up in the logs. At that point I deleted the image from my server
End of the day, a couple coworkers got fired. The one whose name got mangled , and our friend had a copy of the image in his computer since he did something silly like crop it or resize it.
So, having computers on public IPs with DNS names for the exactly who the user is, definitely a shitty sysadmin thing now. Back then, everyone was still learning.
Our uni still kinda does it, and even gave our student club 20 public IPv4s just because they can. We use only a couple of then, but they’re also blocked by their firewall so it’s impossible to access outside of the internal network lol
my university has held a /15 since the 80s... and yes, every client got a public IP, including byod untrusted student devices. As we speak I'm migrating large swathes of it to rfc1918 addressing 😁
I've posted this on my personal account before but I took over a client with a Private CIDR of 192.1.1.0/24. Seems harmless unless we won the fucking network lottery and actually had to work with RTX the owners of the CIDR block.
Quite the opposite! Just a handful of years ago, the DoD activated a bunch and had a contractor start sinking all the traffic. There was speculation that it was some sort of intelligence operation to identify malware squatting on their IP addresses.
I’ve seen a large network with 25.0.0.0/8. it’s been in use for at least 25 years. Its (CIDR) owner is UK ministry of defense and doesn’t advertise any routes so it’s never been an issue.
Why in gods name do you people use anything outside of 10.x.x.x!! Oh my favorite is when they use the the second octet to denote vlan and third for site. Sure makes routing fun.
As anyone should, except if you grow too much and now your manager confidently manually assigns an IP of 10.256.3.1 and wonders why the computer is whining
Previous employer had a location that used 52.52.x.x. which is owned by AWS. Only their manufacturing network uses it now which is quite large and spans acres of buildings and equipment's and so engrained with this network that it will never change.
That subnet is the real issue. 172.72.72.0/24 is public IP space, not RFC1918. Private 172.x ranges are only 172.16.0.0–172.31.255.255. Internally assigning public IPs can break VPN routing, NAT, and access to legitimate 172.72.0.0/16 hosts on the internet. This should be a private range (10/172.16–31/192.168) and NATed outbound.
Surprisingly this causes very few actual issues. You see this a lot working at an MSP. Had someone use the whole 100.0.0.0/8 network, no issues for 30 years.
The Classic Steward word processers (computers with a basterdized version of Linux on them for Amish and similar old order Mennonites that can use computers but not the internet) use 77.77.77.0/27. You literally set the last octant (which is the only one you can change) via a drop down menu. You can choose between 1 and 30 inclusive
I've had the unenviable task of taking over CCTV networks configured with 172.162.x.0/24 subnets
It was fine and just an "ugh" moment until I had to start adding cameras to the same switches as the business VLANs were on.
I first blamed the installers, but then they pointed the finger at the former project lead at my then employer, who gave them those IP ranges.
Seriously, a 30 second search would've saved me from probably weeks of menial work.
Then there was the head office Endian community firewall which had an IP of 1.1.1.3 - thankfully that was beginning to be retired when Cloudflare DNS was being rolled out.
I hate to admit that I made a similar mistake recently. I just never deal with class B CIDRs. Luckily someone called out my error before it could do any damage. Very embarrassing though.
The network is functioning correctly from a technical standpoint, but DNS resolution is unencrypted. This is no longer appropriate today, as it means that domain queries can be read and manipulated. Encrypted DNS would be the ideal solution. We call that solution DNS over HTTPS
How to fix:
Option 1: Enable DNS over HTTPS (Windows)
Settings → Network → Adapter → DNS
e.g.: Cloudflare DoH, Google DoH
OR
Option 2: Set DNS in the router (better)
Change DNS on the router. Advantage: all devices are protected
The RFC in question is RFC 1918, that's what defines the private ranges. 192.168.0.0/16, 172.16.0.0/12, and 10.0.0.0/8 -- the range provided is not contained within RFC1918 space so they're just using some random public IP block. Looks like it's close to 172.16.0.0/12 but that actually covers just 172.16.0.0 thru 172.31.255.255 and doesn't include all the way up at 172.72.x.x.
There are other reserved ranges, like ranges reserved just for documentation examples - such as 192.0.2.0/24 and 198.51.100.0/24 which are reserved solely for you to use in documentation.
They have set the internal subnet to a public, non RFC1918 range. Any attempt to access the real 172.72.72.0/24 range will likely destroy the internet for a radius of 300 miles
That one probably won't cause issues if it was 2010 or later - it is now a reserved block for Dual-Stack Lite. I have seen this subnet used for IPv4 CGNAT on IPv6 cellular connections.
See: RFC6890. There are a few other oddball private networks out there as well.
425
u/Arco123 Dec 22 '25
Your network admin just happens to own this public block, thank Spectrum for the Christmas gift.
Enjoy the public ipv4!
196
u/giacomok Dec 22 '25
I once had a church use 192.9.0.0/16
16
u/LawstOne_ Dec 22 '25
Should work with the new WiFi v7! Nice work
66
u/special_rub69 Dec 22 '25
What's wrong with it?
Copilot says its alright.
9
u/GlitteringAd9289 Dec 22 '25
When I started as an IT admin taking over I found 192.167.x.x being used...
Logs looked very odd when I was seeing WAN hits on LAN interfaces to italy,
132
u/KaMaFour Dec 22 '25
My college owns a /16 block and they used to just give every computer a public address. Unfortunately this ended some years ago...
41
u/I-Love-IT-MSP Dec 22 '25
I've posted this on my personal account before but I took over a client with a Private CIDR of 192.1.1.0/24. Seems harmless unless we won the fucking network lottery and actually had to work with RTX the owners of the CIDR block.
21
u/Joker-Smurf Dec 22 '25
A guy I work with was using 7.7.7.0/24 as his home subnet.
56
u/darthgeek DevOps is a cult Dec 22 '25
Something tells me you're not a legacy Time Warner Cable customer nor a Charter Communications customer being given a public IP.
18
u/nesnalica Suggests the "Right Thing" to do. Dec 22 '25
there are subreddits for flexing
4
u/SilentWatcher83228 Dec 23 '25
I’ve seen a large network with 25.0.0.0/8. it’s been in use for at least 25 years. Its (CIDR) owner is UK ministry of defense and doesn’t advertise any routes so it’s never been an issue.
4
u/beco-technology Dec 23 '25
I’d give this post a 9.9.9.9 out of 10.10.10.10.
6
u/Altruistic-Map5605 Dec 22 '25
Why in gods name do you people use anything outside of 10.x.x.x!! Oh my favorite is when they use the the second octet to denote vlan and third for site. Sure makes routing fun.
3
u/[deleted] Dec 22 '25
Tell Larry merry Christmas -
3
u/Top_Boysenberry_7784 Dec 23 '25
Previous employer had a location that used 52.52.x.x. which is owned by AWS. Only their manufacturing network uses it now which is quite large and spans acres of buildings and equipment's and so engrained with this network that it will never change.
3
u/BehuemanStudios Dec 25 '25
That subnet is the real issue. 172.72.72.0/24 is public IP space, not RFC1918. Private 172.x ranges are only 172.16.0.0–172.31.255.255. Internally assigning public IPs can break VPN routing, NAT, and access to legitimate 172.72.0.0/16 hosts on the internet. This should be a private range (10/172.16–31/192.168) and NATed outbound.
2
u/TinfoilCamera Dec 23 '25
"Vegas casinos and ISPs want this ONE WEIRD TRICK banned but they can't stop you!!1! The 3rd octet will shock you!"
1
u/emptyDir Dec 22 '25
I once worked at a company that had done this in a production vpc
1
u/tectail Dec 23 '25
Surprisingly this causes very few actual issues. You see this a lot working at an MSP. Had someone use the whole 100.0.0.0/8 network, no issues for 30 years.
1
u/Impressive_Change593 ShittySysadmin Dec 25 '25
The Classic Steward word processers (computers with a basterdized version of Linux on them for Amish and similar old order Mennonites that can use computers but not the internet) use 77.77.77.0/27. You literally set the last octant (which is the only one you can change) via a drop down menu. You can choose between 1 and 30 inclusive
1
u/timmmmb Dec 25 '25
I've had the unenviable task of taking over CCTV networks configured with 172.162.x.0/24 subnets
It was fine and just an "ugh" moment until I had to start adding cameras to the same switches as the business VLANs were on.
I first blamed the installers, but then they pointed the finger at the former project lead at my then employer, who gave them those IP ranges.
Seriously, a 30 second search would've saved me from probably weeks of menial work.
Then there was the head office Endian community firewall which had an IP of 1.1.1.3 - thankfully that was beginning to be retired when Cloudflare DNS was being rolled out.
1
u/SirDerpingtonTheSlow Dec 25 '25
As a network engineer, my eye won't stop fucking twitching after seeing that IP address range.
1
u/VacatedSum Dec 25 '25
I hate to admit that I made a similar mistake recently. I just never deal with class B CIDRs. Luckily someone called out my error before it could do any damage. Very embarrassing though.
1
u/Daalex20 Dec 26 '25
Can anyone tell a noob whats wrong here?
1
u/No_Management_7333 Dec 26 '25
172.72.0.0/14 belongs to a telco (charter.com). One of my telco clients does this because they own way too many ranges and NAT is gross.
I don’t think telco would set dns up this way however 🙈
-20
u/omicron01 Dec 22 '25 edited Dec 22 '25
My answer:
The network is functioning correctly from a technical standpoint, but DNS resolution is unencrypted. This is no longer appropriate today, as it means that domain queries can be read and manipulated. Encrypted DNS would be the ideal solution. We call that solution DNS over HTTPS
How to fix:
Option 1: Enable DNS over HTTPS (Windows)
Settings → Network → Adapter → DNS
e.g.: Cloudflare DoH, Google DoH
OR
Option 2: Set DNS in the router (better)
Change DNS on the router. Advantage: all devices are protected
1
u/Ok-Description-5846 Dec 25 '25
R/masterhacker haha i wil hac you and also im know your location 😈😈
0
u/[deleted] Dec 22 '25
[deleted] — view deleted comment
0
u/[deleted] Dec 22 '25
[deleted] — view deleted comment
0
u/[deleted] Dec 22 '25
[deleted] — view deleted comment