Apr 142011
 

This is one of those things that I was under the impression was widely understood (at least amongst a certain specialist population of IT people), but apparently not.  As anyone who has ever paid extra for a static IP address, a network block has some notional monetary value. To give you an idea of how much, a quick search shows that a certain ISP (it doesn’t matter which one) charges $2.50 per month for a static IP address.

The scales up to a value of $637 for a /24 network block, $163,000 for a /16 network block, and $41 million for a /8 network block. These values are of course wildly unrealistic given that network blocks can’t be sold (or at least not usually, although I do know people who have sold them). But let’s assume they do have a monetary value – after all with the starvation of IP addresses it is not impossible that network blocks could be traded.

Physical objects are subject to depreciation to represent the declining value to the organisation – a 10 year old server may eventually have an interest to a museum, but an organisation is likely to realise that it makes more sense to replace it.

Network blocks are also subject to depreciation although it is not time dependent but depends on what use is made of that network block. If we assume that network block A has been assigned to a bunch of unrepentant scamming spammers, what is likely to happen ? Well as spam floods their networks and servers, network administrators and system administrators will start to block addresses within network block A.

Some of the blocklists are collectively run, but some are run by individual organisations. In the later case you cannot ensure that these will ever be removed. As a network block gradually acquires more and more entries in numerous blocklists around the world, it becomes of less use to those who want to use it. It decreases in value.

Similarly when a network block (let’s call it “B”) is used for a collection of workstations run by users whose interest does not extend to keeping their machines secure, it will be populated by machines infected with various forms of malware. As such, it is also subject to being cast into the blocklists of the world. In most cases, the users will not notice, but if that network block ever gets reallocated to servers, those servers are subject to problems caused by historical entries in blocklists.

So each malware infection a machine is subject to has a cost associated with it – it has decreased the value of the network address it uses by a tiny amount. Over time and with enough long-lived malware infections, it is possible that a network block will have a much lower value than an unused network block.