What's a bogon?

A bogon route is a type of route which shouldn't exist on the global Internet. More specifically, "bogon" (derived from the word "bogus") refers to an advertisement for a prefix within a reserved or otherwise unallocated IP network.

A service provider assigns IP prefixes to customers from the blocks it receives from its regional Internet registry (RIR) like ARIN or RIPE. These registries in turn have been granted large chunks of the IP address space from IANA. To date, most of the IPv4 address space has already been allocated to registries; this address space shortage is the primary motivation behind the migration to IPv6. However, some IPv4 blocks remain unallocated or reserved, and should never be seen on the Internet.

A current list of all prefixes as allocated (or not) by IANA can be found here. The list effectively partitions the sum of all IPv4 address space into 256 /8 chunks and lists the status of each. Below is an excerpt from IANA's database:

Prefix  Designation                       Date      Whois               Status

000/8   IANA - Local Identification       1981-09                       RESERVED
001/8   IANA                                                            UNALLOCATED
002/8   IANA                                                            UNALLOCATED
003/8   General Electric Company          1994-05                       LEGACY
...
076/8   ARIN                              2005-06   whois.arin.net      ALLOCATED
077/8   RIPE NCC                          2006-08   whois.ripe.net      ALLOCATED
...

Notice the status of each block. 0.0.0.0/8 is reserved whereas 1.0.0.0/8 and 2.0.0.0/8 are unallocated. A route advertising a subnet within any of these blocks is considered a bogon. The remaining addresses in the excerpt are valid; 76.0.0.0/8 and 77.0.0.0/8 have been allocated to ARIN and RIPE, respectively, and 3.0.0.0/8 was assigned to General Electric in the early days of the Internet back when IANA assigned prefixes to organizations directly.

So why do bogons appear on the Internet in the first place? Unfortunately, many ISPs fail to prudently filter route advertisements they receive from customers. As such, bogon routes originated from these customers sometimes make it onto the Internet. This may be accidental, as is typically the case with reserved ranges, or it may be done maliciously by a site serving malware, for example.

Fortunately blocking bogon routes at a high level is fairly straightforward. A number of bogon lists are maintained to ease the implementation of bogon filters, such as those by Team Cymru. More advanced methods of bogon tracking include peering with a dedicated route server or automatically referencing WHOIS filters, but updating a simple access list on a regular basis will suffice for most organizations. The key is to remember that the bogon list is dynamic, and prefixes will be added and removed over time.