AS668

AS668 (DNIC-AS-00668) is an active, currently-announcing autonomous system registered to the United States Department of Defense and operated as DREN — the Defense Research and Engineering Network — under DoD's High Performance Computing Modernization Program (HPCMP).

ARIN's registry records the ASN's top-level allocation as 1990-04-24, with the record last changed 2025-09-12. The registrant organization is USDDD (United States Department of Defense), administered through the DoD Network Information Center (DNIC) at DISA's Columbus, Ohio facility, which also handles abuse and administrative contacts.

DREN carries DoD's high-performance-computing research, engineering, and test-and-evaluation traffic. Its fourth-generation backbone (DREN 4, completed June 2023) links DoD Supercomputing Resource Centers and 150+ distributed sites at 1–100 Gbps, has run dual IPv4/IPv6 since 2003, and splits into a DoD-only (DO) segment with no internet routes and a Public External (PX) segment that peers and transits. A separately encrypted overlay, SDREN, carries classified traffic.

Unlike a dormant legacy ASN, AS668 is live in the global routing table: RIPEstat's snapshot lists prefixes including 128.160.0.0/17, 140.27.8.0/22, and 192.88.110.0/24, among others (the source list was truncated, so this is a partial sample). Third-party BGP aggregators disagree on the exact scale, reporting somewhere between roughly 187 and 217 IPv4 prefixes; CAIDA ranks it 1532 globally with a customer cone of 21 ASNs and 280 prefixes.

Exposure

Live-routed government network with a sizeable customer cone (21 ASNs, 280 prefixes per CAIDA) and 150+ connected sites; the internet-facing PX segment is the relevant exposure surface, not the internal DO segment.

Routing hygiene

HE's BGP toolkit flags AS668 as "announces bogons" and shows zero RPKI-valid originations as of 2026-07-18 — a hygiene gap worth noting, not a confirmed abuse finding.

Abuse signal

No CVE, botnet/C2 report, or named incident ties to AS668; CleanTalk shows a 0.00% currently-active spam rate in its sampled block. Spamhaus could not be queried directly, so that channel stays Unknown rather than "clean."

Disambiguation

AS668 is not AS8003, the ASN behind the widely-covered 2021 "Pentagon activates dormant IPv4 space" honeypot story — the two are frequently conflated in casual references.

Operator

United States Department of Defense (DoD); ARIN registrant org USDDD, administered by the DoD Network Information Center (DNIC); operationally run as DREN under HPCMP [Confirmed] — https://rdap.arin.net/registry/autnum/668, https://www.hpc.mil/solution-areas/networking

Country / RIR

US, ARIN [Confirmed] — https://rdap.arin.net/registry/autnum/668

Allocated

1990-04-24 (ARIN RDAP autnum TOP-LEVEL registration event, distinct from the entity/org-level dates nested under entities[]); last changed 2025-09-12 [Confirmed] — https://rdap.arin.net/registry/autnum/668

Org status

Active (ARIN RDAP autnum status); HPCMP is an active DoD/DoW program office established 1992, headquartered in Vicksburg, MS [Confirmed] — https://rdap.arin.net/registry/autnum/668, https://www.hpc.mil/solution-areas/networking

Security/abuse

no CVE, botnet/C2 report, or named incident ties to AS668 specifically; CleanTalk shows 0.00% currently-active spam rate in its sampled 6.0.0.0/8 block (2,398 of 16,777,216 IPs ever flagged historically, 0 currently active); HE's BGP toolkit flags AS668 as "announces bogons," a routing-hygiene flag rather than an abuse allegation; Spamhaus's authoritative lists could not be queried directly [Likely for clean abuse record; Unknown for Spamhaus] — https://cleantalk.org/blacklists/as668/6.0.0.0/8, https://bgp.he.net/AS668

Network & routing

Network type

government/research WAN — DoD HPC research, engineering, and test-and-evaluation network (DREN 4 backbone); PeeringDB self-lists as Educational/Research [Confirmed] — https://www.hpc.mil/solution-areas/networking/dren-sdren-network-capabilities-and-technical-overview, https://www.peeringdb.com/api/net?asn=668

Routing status

actively announced, not dormant — RIPEstat listed at least 7 prefixes as of 2026-07-18 (128.160.0.0/17, 199.209.144.0/22, 140.27.8.0/22, 192.88.110.0/24, 198.253.40.0/21, 214.29.136.0/21, 198.253.168.0/21); the source list was truncated mid-array so this is a partial sample, not the full announced set [Confirmed for sample; Unknown for total count] — https://stat.ripe.net/AS668

CAIDA AS rank

1532; customer cone 21 ASNs / 280 prefixes / 3,457,792 addresses; asnDegree 38 total = 3 providers / 15 peers / 20 customers [Confirmed] — https://asrank.caida.org/asns/668

Upstreams / peer sample

CAIDA reports 3 providers, corroborating the WebSearch-derived "~3 upstreams" figure; the specific upstream ASNs and a reliable per-ASN peer sample could not be attributed to an authoritative source, so the enumerated identities stay Unknown while the ~3 count is Confirmed [Confirmed for count; Unknown for enumerated ASNs] — https://asrank.caida.org/asns/668, https://bgp.he.net/AS668

RPKI

Unknown at the per-prefix level — the RIPEstat rpki-validation call was self-skipped ("no --prefix supplied"), and RPKI validity is assessed per prefix, not per ASN; HE's BGP toolkit separately reports zero RPKI-valid originations as of 2026-07-18 [Unknown for posture; Confirmed for the zero-valid flag] — https://stat.ripe.net/AS668, https://bgp.he.net/AS668

Peering policy

no dedicated peering-policy page found on hpc.mil; a self-managed PeeringDB record (net "DREN (aka HPCMP)", org id 1947) lists policy_general = Open, favoring peers supporting IPv4+IPv6, unicast+multicast, and 9K jumbo MTU [Likely] — https://www.peeringdb.com/api/net?asn=668

Notable usage

DREN 4 backbone (completed June 2023) connects DoD Supercomputing Resource Centers and 150+ distributed sites at 1–100 Gbps, fully dual-stack IPv4/IPv6 since 2003 (DoD's first IPv6 network); splits into a DoD-only (DO) segment with no internet routes and a Public External (PX) peering/transit segment; hosts SDREN, an NSA Type-1-encrypted overlay

[Confirmed] — https://www.hpc.mil/solution-areas/networking/dren-sdren-network-capabilities-and-technical-overview

ASN / name

AS668 — DNIC-AS-00668 [Confirmed] — https://rdap.arin.net/registry/autnum/668

Prefix counts

third-party BGP aggregators disagree — one synthesis reports 187 IPv4 / 2 IPv6 originated (310 total incl. non-originated announcements); another reports 217 IPv4 / 140 IPv6. Treat as a conflicting range, not a fixed figure [Likely] — https://bgp.he.net/AS668, https://bgp.tools/as/668

Address estimate

~2,656,000 IPv4 addresses per BGP aggregator snapshots; CAIDA's customer-cone metric (a different measure — cone size, not announced space) is 3,457,792 addresses [Likely] — https://bgp.he.net/AS668, https://asrank.caida.org/asns/668

Registrant / admin address

USDDD org address 3990 E. Broad Street, Columbus, OH 43218; abuse/NOC (MIL-HSTMST-ARIN) and admin/technical (REGIS10-ARIN) contacts both list DISA-Columbus, 300 North James Road, Whitehall, OH 43213 — this is DISA's registration/admin office, not the network's physical or routing footprint

[Confirmed] — https://rdap.arin.net/registry/autnum/668

Disambiguation

AS668 is NOT AS8003, the ASN behind the widely-reported 2021 "Pentagon activates dormant IPv4 space / world's largest honeypot" story (7.0.0.0/8, 11.0.0.0/8, 22.0.0.0/8 via the GRSCORP pilot) [Confirmed] — https://mailman.nanog.org/pipermail/nanog/2021-March/212569.html, https://www.theregister.com/2021/04/26/defense_department_ipv6/