Technical Sales Alliance

IPv4 Bogon Ranges (Static Bogon Table)

IPv4 Bogon Ranges (Static Bogon Table)

Page Title: IPv4 Bogon Ranges — What They Are and Why They Matter

Overview
Bogons are IPv4 address ranges that should never appear on the public Internet because they are either unallocated, reserved, private, or otherwise non-routable. When bogon addresses appear in firewall logs, SIEM alerts, packet captures, or threat intelligence feeds, they are almost always indicators of:

  • Misconfigurations

  • Malicious scanning

  • IP spoofing

  • Botnet activity

  • Outbound leaks from improperly secured networks

This CSV provides a static, foundational bogon table based on RFC-defined non-routable IPv4 ranges. While live bogon lists change as IP space is allocated over time, certain ranges will always be bogons.

What This CSV Contains

This CSV includes:

  • RFC1918 private ranges

  • Loopback ranges

  • Link-local ranges

  • Documentation-only networks

  • Benchmarking networks

  • Multicast ranges (when used as unicast)

  • Reserved or experimental blocks

  • The universal broadcast address

Each entry includes:

  • CIDR range

  • Category

  • Detailed explanation

This CSV is perfect for:

  • Security analysts

  • Firewall engineers

  • SIEM tuning

  • Threat detection modeling

  • SOC documentation

  • Basic networking education

Edit
CIDRCategoryNotes
0.0.0.0/8This Network / BogonUnspecified network; should never be seen as a routable source or destination on the public Internet.
10.0.0.0/8Private RFC1918Internal-use only; not globally routable. Considered bogon if seen transiting the public Internet.
127.0.0.0/8LoopbackLocal host loopback. Any appearance on the wire indicates misconfiguration or spoofing.
169.254.0.0/16Link-LocalAuto-assigned when DHCP fails. Not routed. Bogon if seen beyond a local segment.
172.16.0.0/12Private RFC1918Internal-use only; should not cross the public Internet.
192.168.0.0/16Private RFC1918Home/SMB private space. Bogon if transiting the public Internet.
100.64.0.0/10CGNATCarrier-grade NAT address space. Should not be visible as public source/destination on the open Internet.
192.0.2.0/24TEST-NET DocumentationReserved for documentation; not used for live networks. Bogon if routed.
198.51.100.0/24TEST-NET DocumentationReserved for documentation and examples. Bogon if routed.
203.0.113.0/24TEST-NET DocumentationReserved for documentation and examples. Bogon if routed.
198.18.0.0/15BenchmarkingReserved for performance testing of network devices. Should not appear on the public Internet.
224.0.0.0/4MulticastClass D addresses; not used as unicast. Bogon if seen where unicast should be used.
240.0.0.0/4Reserved / Future UseExperimental / reserved. Not normally routed; generally treated as bogon on the public Internet.
255.255.255.255/32Limited BroadcastLocal broadcast only. Bogon if seen on routed links or outside its L2 domain.