Bogon IP Filtering: How ISPs & BGP Routers Drop Unallocated & Spoofed IP Ranges

What Are Bogon IP Addresses and Martian Packets?

In global internet routing, a Bogon IP (also known as a Martian packet) is an IP address that should never appear as a source or destination on the public internet. These include unallocated address blocks (reserved by IANA) and private IP ranges (such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 defined in RFC 1918).

Why Cybercriminals Exploit Bogon Addresses

Because UDP is a connectionless protocol, malicious actors forge the source IP header of outgoing packets with Bogon addresses:

• DDoS Reflection & Amplification: Attackers send queries to open DNS or NTP servers spoofing the victim IP, amplifying attack volume.
• Untraceable Reconnaissance: Port scanners sending SYN probes with Bogon source IPs hide the scanner true origin.

Implementing Bogon Filtering with Team Cymru BGP Feeds

Enterprise network engineers and transit ISPs deploy automated Bogon filtering using real-time BGP peering feeds provided by cybersecurity organizations like Team Cymru:

1. Full Bogon BGP Peering: Routers establish a BGP multihop peering session with Team Cymru route collectors.
2. Blackholing Bogons via Null0: Any route announced in the Bogon feed is tagged with the blackhole community, dropping invalid packets in hardware ASIC silicon before they enter the core backbone.
3. Strict Unicast Reverse Path Forwarding (uRPF): Edge routers verify that the source IP address of every incoming packet has a matching reverse route in the routing table.

Learn more about internet infrastructure in our guide on DoH vs DoT DNS encryption.

Check if your public IP address is clean and verify your ASN reputation on our free online IP scanner.