TL;DR
The IPv4 space once dubbed the ‘swamp’ for its small, fragmented assignments now resembles that disorder across much of the address space. Analysis of the last five /8 allocations and routing data shows prefix sizes trending smaller, route counts rising, and implications for security and mitigation practices.
What happened
Historically, portions of the IPv4 address space were labeled the “swamp” because large swaths of addresses—notably the original 192/8 block—were split into many small /24 assignments that prohibited aggregation and complicated routing. After IANA distributed the final five /8s to Regional Internet Registries (RIRs) in 2011, those blocks have largely been allocated or assigned over the following decade. Measurements show that small prefixes remain dominant: /24s account for more than half of routing table entries (closer to 60% today), while the full IPv4 routing table has grown to roughly one million entries from about 150,000 two decades earlier. The distribution of block sizes from the last free pools tended toward about /22 in 2014, but by 2024 some registries show even smaller allocations, including registrations below /24. The result is an address space whose fragmentation and volatility revive characteristics once confined to the old “swamp.”
Why it matters
- Routing table growth and proliferation of small prefixes challenge aggregation and increase load on routing infrastructure.
- Smaller, more volatile address assignments complicate threat mitigation and reputation-based defenses.
- Market-driven transfers of legacy blocks and concentrated acquisition by large cloud providers change who controls address topology.
- Persistent IPv4 scarcity has reinforced NAT use and spurred continued interest in IPv6, but IPv6 has not eliminated IPv4 fragmentation according to the source.
Key facts
- The informal term “swamp” referred to heavily disaggregated portions of IPv4 (not formally defined in the source).
- IANA distributed the last five IPv4 /8 blocks to RIRs in February 2011.
- At the turn of the century about 80% of 192/8 had been assigned and much of it appeared as disaggregated /24 routes.
- Today, /24 route advertisements make up more than 50% of routing table entries and hover closer to 60%.
- A full IPv4 routing table is approximately 1,000,000 entries today versus roughly 150,000 about two decades earlier.
- By the end of 2014, APNIC and ARIN had allocated a sizable share of their last /8s; by 2024 nearly all five RIRs had allocated or assigned almost all addresses from those /8s.
- Table data in the source show 2024 allocation/assignment percentages for the last /8s: AFRINIC 87%, APNIC 97%, ARIN 99%, LACNIC 100%, RIPE 99%.
- Average prefix sizes from the last free pools trended around /22 in 2014; by 2024 some registries (ARIN and LACNIC) reported smaller blocks and RIPE showed registrations below /24 in some cases.
- Market behaviors noted in the source include transfers of large legacy blocks for substantial sums and acquisition activity by major cloud providers.
- Network Address Translators (NATs) remain widely used, and IPv6 deployment interest continues to grow (as reported in the source).
What to watch next
- Whether the broader IPv4 address space continues to mirror the old ‘swamp’ pattern of pervasive small prefixes — not confirmed in the source.
- How continued routing table growth will affect router capacity and network operational practices — not confirmed in the source.
- Changes in RIR distribution policies or market mechanisms that influence block sizes and transfers (address market activity is documented historically, future changes not confirmed in the source).
- Evolving impacts of address volatility on threat mitigation effectiveness and reputation systems (the source documents current effects but future trajectories are not confirmed in the source).
Quick glossary
- IPv4: Internet Protocol version 4, the fourth version of the Internet Protocol used to identify devices on a network via 32-bit addresses.
- /24 (prefix): A common IPv4 subnet size that contains 256 addresses; widely used as a minimal routable block in the global routing system.
- RIR: Regional Internet Registry, an organization that manages the allocation and registration of Internet number resources (addresses) within a region.
- NAT: Network Address Translation, a technique that allows multiple devices on a private network to share a single public IPv4 address.
- Routing table: A database in a router listing network destinations and the next hop to reach them; its size affects router memory and processing requirements.
Reader FAQ
Was the term “swamp” ever formally defined?
No; the source says the term was used casually and was not formally defined.
Have the last IPv4 addresses been assigned?
IANA distributed the final five /8s in 2011 and, according to the source, by 2024 RIRs had allocated or assigned nearly all of those addresses.
Is routing table growth a new problem?
Routing tables have grown substantially: the full IPv4 table is roughly one million entries today compared with about 150,000 two decades earlier, per the source.
Has IPv6 resolved the IPv4 ‘swamp’ issue?
The source notes growing interest and deployment of IPv6, but whether IPv6 has resolved the fragmentation and operational issues is not confirmed in the source.
Greg Skinner December 25, 2025 at 4:54 am I don’t think ‘swamp’ was ever formally defined. Dave Mills used it to casually refer to networks he worked with. As you…
Sources
Related posts
- Bridge Anonymization: Local, reversible PII scrubber for translation pipelines
- Spaced repetition: scheduling reviews to improve long-term learning outcomes
- How to Build a 100TB TrueNAS NAS in 2025: Complete DIY Storage Guide