The internet as we know it is a global graph of independent Autonomous Systems (AS) running Border Gateway Protocol (BGP) to exchange reachability information across network boundaries dynamically. Beneath this global routing topology, traffic relies on IP addressing, balancing legacy IPv4 allocations extended by CIDR and NAT with the steady growth of IPv6, while Interior Gateway Protocols (IGPs) like OSPF direct packets inside each AS and ICMP provides essential control-plane diagnostics along the path.

Blown your head with jargon already? Good.

In layman’s terms, think of the internet as a world full of separate towns (Autonomous Systems). The major highways connecting these towns are governed by BGP, which tells every town how to reach every other town. Each house in a town has a unique address (an IP address), and a group of houses on the same block forms a neighbourhood (a subnet).

When you send a letter to a neighbour down the street, your local mail truck relies on internal street maps (an IGP like OSPF) to find the fastest local route. If you send a letter to another town entirely, your local postal service drives the letter to the town’s highway border, hands it off to BGP, and BGP routes it across the global highway network until it hits the destination town’s local mail system. If the destination house doesn’t exist or a highway is closed? That’s where ICMP comes in—it’s the official system that sends a “return to sender” slip or error report back to your mailbox so you know what went wrong along the way.

Now, imagine one of those towns suddenly starts sending letter bombs. Imagine that town grows, consuming and infecting the towns around it. Imagine this infection spreading endlessly, where every corrupted house in the system can kill you the moment it becomes aware of your IP address.

What you have there is the DataKrash of the Cyberpunk universe—and the catalyst for the subject of this post: The Blackwall.

Blackwall?

“Eddie, haven’t you already made a post on the blackwall?”

I made a post on Project Blackwall, my home network overhaul. I name all my projects and devices after things from the cyberpunk universe. I have a whole other post I am writing about this, so I won’t get into why. The Blackwall was only breifly describes in that post as “The mother of all firewalls”, and while that title gives a round about idea of what it does it doesnt accurately capture what The Blackwall is from a technical standpoint.

“Mike Pondsmith wrote a white paper on The Blackwall?”

Well… no… At least not as far as I am aware.

You see, the thing is, I am a nerd. Nerds have special interests, and there is no greater joy in my heart than when I find a way to interlink two of my special interests. Cyberpunk and Tech go so beautifully hand in hand that when I first played the game, one of the first questions I began to ask myself was, “I wonder if this universe has fully adopted IPv6?” During Project Blackwall, I began to ask myself “I wonder how The Blackwall” actually works, and upon studying my CCNA I began to theorise that the Blackwall is not actually a Firewall and what Netwatch actually do. This comes later, however, as I know that despite my borderline obsession with Cyberpunk, not everyone has played the game, and while the Blackwall is not arcane knowledge as far as Cyberpunk Lore goes, the specifics around the DataKrash are. In order for you to fully understand this post, you’re going to have to endure a Lore dump.

Now there really is not an easy way to just “dump” all of this information in a tidy way, but bear with me - I am going to do my best.

This is Rache Bartmos - He is arguably the greatest netrunner in cyberpunk lore. A netrunner is effectively a hacker; there is more to it, but for now just stick with that. Throughout the 2000’s and 2010’s he routeinely sabotages corperations, and completed various other technical feats. What is most important is that in 2024 during the Ihara-Grubb Net reform (dont ask, its not important in this context), he seeded the global archtecture with R.A.B.I.D.S.

What is R.A.B.I.D’s? Roving Autonomous Bartmoss Interface Drones; they were designed to breach all corporate data fortresses (private data shares) and share their data online for all to see. The code for R.A.B.I.D.S was based on SoulKiller, which was coded by Alt Cunningham, girlfriend to Jonny Silverhand. The plan was deploy these upon Bartmos’s death - and just like clockwork, when NetWatch killed Rache Bartmos the R.A.B.I.D.S triggered. The problem was they did their job too well. They infected 78.2% of all systems and triggered Artificial Intelligences to mutate and go rogue. NetWatch was unable to destroy the viruses, so they quarantined them behind The Blackwall.

In the lore, the Blackwall is an AI whose prime directive is to block off sections of the net which have been overrun such that the rest of the Net could be salvaged. There are rumours that Netwatch was only able to do this with the asstiance of an enclave of Rouge AI’s, who wanted to seperate themselves from human observation for their own reasons.

Lore dump done.

And now… Networking

And now a lore dump for another dystopian hellhole - Modern day networking. Yes, I really wish I did not have to write this out. However, if I consider my networking knowledge to be above average (which by all rights it is), and I do not know dick-all about BGP, I think it is safe to assume you, my dear reader, also do not know about BGP. The next section kinda requires knowing what that is, as well as subnetting. Consider this to be sort of a taster for my CCNA course I’ll make if I ever get famous, as making a course seems to be the meta for sellout tech YouTubers.

For the record, I am dropping the house analogy for this bit… Cry about it.

Subnetting

An IPv4 address is a 32-bit binary integer divided logically into two distinct components: a Network Identifier and a Host Identifier. The boundary between these two fields is defined dynamically by a subnet mask (or CIDR prefix length). Out of the $2^{32}$ total theoretical IPv4 addresses ($4,294,967,296$), allocation as a single flat address space is functionally impossible; line-rate routing lookup tables would implode under the sheer volume of individual host routes.

Subnetting applies hierarchical aggregation to IP space. Regional Internet Registries (RIRs) assign large CIDR blocks (such as a /8 or /16) to ISPs and enterprises. Network engineers then execute VLSM (Variable Length Subnet Masking) to divide these blocks into smaller subnets — such as carving a /16 (65,536 addresses) down into multiple /24 subnets (256 addresses each, with 254 usable host addresses). This enforces localised broadcast domains, enables route summarisation, and dictates the structural boundaries of Layer 3 routing domains. If a host or interface isn’t bound to an allocated prefix within a reachable subnet, it cannot participate in L3 routing.

BGP

Where subnetting defines logical IP boundaries, BGP (Border Gateway Protocol) is the Path-Vector protocol that advertises reachability for those prefixes across the global internet. The internet lacks a centralised routing authority. Instead, it is a graph of interconnected Autonomous Systems (AS) — distinct administrative routing domains assigned an Autonomous System Number (ASN).

BGP operates over TCP port 179 to establish peering sessions between routers across AS boundaries (eBGP) or within the same AS (iBGP). Rather than sending raw metric scores like IGP protocols, BGP exchanges Network Layer Reachability Information (NLRI)— explicitly stating: “AS 65001 can reach prefix 192.0.2.0/24 via path [AS 65001, AS 64512].” Neighbouring BGP speakers evaluate these advertisements against local policy attributes (such as LOCAL_PREF, MED, and AS_PATH), update their Local Routing Information Base (Loc-RIB), and selectively re-advertise the best paths to their own peers. It is a policy-driven, trust-based routing mechanism operating at planetary scale.

I learnt this for this blog post. I am not asking for appreciation, but just know I respect the craft more than you bastards realise.

Real World Implications

So let’s imagine that tomorrow, 78.2% of all usable IPv4 space suddenly becomes completely unusable. What does that actually look like at Layer 3? (For the record, I am choosing not to include IPv6 in this analysis). Overnight, nearly four-fifths of the global BGP routing table isn’t just degraded—it’s violently withdrawn. Entire Autonomous Systems vanish, vast swathes of IP prefix space are rendered instantly toxic, and global transit corridors shatter as core routers drop routes faster than they can converge. With over three-quarters of the internet’s logical address space burned to the ground, the remaining surviving subnets are immediately choked into isolated islands, forced to sever external peering links just to stop the route corruption from bleeding across their own borders.

IRL, the DataKrash would be a technical and societally defining event, just as it is in the cyberpunk lore. This, however, is where the similarities stop. If you ask any non-technical gamer what the Blackwall is, they will say it is a giant digital fence keeping bad AI’s out. Ask a junior sysadmin, and they’ll call it a massive stateful inspection firewall running deep packet inspection at line rate. The thing is, if Project Blackwall and Project Delemain have taught me anything (yes, I can draw on my own experience to make this claim), global line-rate filtering using stateful packet inspection is not possible. My network nearly shit itself when I hairpinned all trafiic up to OpnSense, and that is just inside the 10.67.0.0/16 subnet - there is not enough compuute power in the world to do it across the entire 0.0.0.0/0 range.

Basing this entirely on IRL Newtworking technolgies, and forgetting cyberpunk lore (because I know some nerd is foaming at the mouth to tell me I am wrong here) - Netwatch did not build a firewall, it execute a global BGP Blackhole Stratergy… Probably using Ansible. (Okay, the Ansible bit is just a bit of fan fiction, but roll with me).

The Blackwall - A white paper

Let’s talk about how you actually execute a global BGP Blackhole strategy when 80% of the internet descends into bit-hell.

In enalls, track TCP control flags (SYN, ACK, FIN), maintain session tables in RAM, and run Deep Packet Inspection (DPI) at Layer 7. Under a planetary-scale assault, connection tracking state tables implode, RAM maxes out, and the control plane dies.

Instead, you execute a Remotely Triggered Blackhole (RTBH).

Remotely Triggered Blackhole (RTBH) & The Null 0 Interface

For the uninitiated: Null 0 (or null0) is the router equivalent of a bit bucket - It is a pseudo-interface representing a digital void. When a packet matches a route pointing to Null 0, the router’s TCAM (Ternary Content-Addressable Memory) and forwarding ASIC drop the packet silently at hardware line-rate. It bypasses the CPU, skips state-table processing, and doesn’t waste clock cycles generating ICMP Type 3 Code 1 (Destination Host Unreachable) error packets.

In Destination-Based RTBH, a trigger router inside an Autonomous System injects a /32 host route (or aggregate prefix block) into the internal BGP (iBGP) mesh, using a specific BGP Community attribute. Edge routers receiving this update rewrite the Next-Hop IP to a static route pointing to Null 0.

Here is the exact Cisco IOS/Arista syntax for how an enterprise edge router configures Destination RTBH via BGP:

1. Define a static route pointing an unused RFC 1918 prefix to Null 0

ip route 192.0.2.1 255.255.255.255 Null0

2. Define a Route-Map to catch the Blackhole BGP Community Tag (e.g., 65000:666)

route-map RTBH-IMPORT permit 10
 match community BLACKHOLE-TAG
 set ip next-hop 192.0.2.1
 set local-preference 200

3. Match the well-known or custom BLACKHOLE Community.

ip community-list standard BLACKHOLE-TAG permit 65000:666

4. Apply the route-map to iBGP neighbour updates.

router bgp 65000
 bgp log-neighbor-changes
 neighbor 10.255.255.2 iBGP-PEER
 neighbor 10.255.255.2 route-map RTBH-IMPORT in

When Netwatch isolated 78.2% of the internet, they didn’t deploy firewalls — they automated this exact mechanism across global Internet Exchange Points (IXPs) using automated control-plane scripts, injecting 666 blackhole community attributes into global BGP tables to instantly drop infected traffic at the ASIC level.

Strict eBGP Peering Filters & BGP Route Dampening

Any surviving corporate subnet or regional intranet attempting to peer with Netwatch’s core Tier-1 transit infrastructure had to pass brutal Border Gateway Protocol policy controls. If a compromised AS or rogue AI attempted to advertise poisoned prefixes or unstable routes across the border, Netwatch didn’t analyse the packets — they used BGP Route Dampening to kill the BGP session at the control plane.

BGP Dampening assigns a penalty value to an eBGP peer every time a prefix “flaps” (advertised and withdrawn repeatedly). If the cumulative penalty crosses a defined suppress threshold, the router refuses to process advertisements from that peer entirely for a set maximum penalty time.

# Netwatch Core Border Policy: Aggressive BGP Route Dampening
router bgp 65000

# Parameters: <half-life> <reuse-limit> <suppress-limit> <max-suppress-time>
bgp dampening 15 750 2000 45
 
# Ingress Prefix List - Hard-denying unallocated or infected Legacy IPv4 blocks
ip prefix-list NETWATCH-DENY-BLACKHOLE seq 5 deny 100.0.0.0/8 le 32
ip prefix-list NETWATCH-DENY-BLACKHOLE seq 10 deny 168.0.0.0/8 le 32
ip prefix-list NETWATCH-DENY-BLACKHOLE seq 15 permit 0.0.0.0/0 ge 8 le 24

neighbor 198.51.100.2 remote-as 65501
neighbor 198.51.100.2 prefix-list NETWATCH-DENY-BLACKHOLE in

If a rogue node attempts to hijack a prefix or flood route updates, the penalty spikes past 2000, and Netwatch’s edge routers suppress the BGP peer for 45 minutes without human intervention.

Control-Plane Air-Gapping & Non-Existent Forwarding Paths

The “Old Net” wasn’t walled off by a glowing digital barrier; it was excised from the global FIB (Forwarding Information Base).

In Layer 3 networking, a router cannot forward a packet if its RIB/FIB has no valid entry for the destination address. Netwatch simply removed the routes for infected Autonomous Systems from the global default-free zone (DFZ).

# Verification on a Netwatch Border Router showing total isolation of infected subnets
Netwatch-Edge-Core01# show ip route 100.64.10.1
% Network not in table

Netwatch-Edge-Core01# show ip bgp 100.64.0.0/16
% No matching BGP routes found in Loc-RIB.

When a rogue AI or infected node on the bad side of the wire attempts to initiate a TCP session to a surviving human server, its packet hits an edge router whose FIB literally reads: % Network not in table.

The packet doesn’t get inspected. It doesn’t trigger a firewall log. It hits the end of the routing table, fails the default route lookup, and is dropped into the ether. They exist in completely disconnected routing domains.

Reclimation

In the official lore, Netwatch can’t reclaim any of the Old Net virtually. Once a node or server cluster goes dark, connecting it back to the wire is immediate suicide. R.A.B.I.D.S self-replicate across the backbone, and rogue AIs flood the link the second a cable lights up. Lore-wise, their only recourse is physical recovery: sending teams into abandoned server farms, ripping out hard drives, bleaching the hardware, and spinning up completely isolated “CitiNets” that never touch the broader world. The actual virtual territory of the Old Net remains 100% lost.

However, in a real-world OSI TCP/IP network stack, reclaiming that lost territory is technically possible.

You wouldn’t attempt to cleanse the code or fight the AIs at Layer 7. Instead, you execute a Dynamic Prefix Shrinking & Containment Strategy on the Layer 3 routing plane. You monitor infected subnets, quarantine clean blocks, confirm stability, and incrementally carve usable IP space out of the void.

[ Infected /8 Block (Null 0) ]
                     │
         (1) Passive Traffic Taps
                     │
       [ Candidate Subnet Identified ]
                     │
         (2) Move to Quarantine VRF
            (Community: NO_ADVERTISE)
                     │
      ┌──────────────┴──────────────┐
  [AI Activity Detected]      [Zero Activity]
      │                             │
 (Re-Blackhole)             (3) Active L3/L4 Probes
 (Community: 666)                   │
                              [Passed Probe]
                                    │
                     (4) Re-advertise to Safe BGP Table
                     (Shrink Blackhole Mask to /20, /24)

Here is how that plays out step-by-step on an enterprise routing plane:

1) Passive Telemetry Taps Netwatch deploys passive monitoring nodes (looking glass routers) at the border of blackholed subnets. These nodes do not advertise routes into the infected space; they simply analyse ingress telemetry and NetFlow/IPFIX data. When a specific prefix (say, a /20 block) shows zero malicious packet bursts, zero SYN floods, and zero rogue AI handshake attempts over a prolonged window, it is flagged as candidate space for reclamation.

2. Micro-Quarantine via VRFs & Community Scoping Before connecting that prefix to anything, Netwatch pulls it out of the global Null 0 bucket and assigns it to an isolated Quarantine VRF (Virtual Routing and Forwarding) instance, tagging it with a NO_ADVERTISE BGP community attribute.

# Step 1: Transition candidate prefix from Global Blackhole to Quarantine VRF
ip route vrf QUARANTINE_ZONE 100.64.16.0 255.255.240.0 192.0.2.1

# Step 2: Tag prefix so border routers refuse to advertise it to external peers
route-map QUARANTINE-POLICY permit 10
 set community 65000:999 NO_ADVERTISE

Because it is tagged NO_ADVERTISE, the prefix exists strictly inside a sandboxed routing table. Edge routers won’t pass it to the human “safe-net,” and rogue entities inside the zone still have no routing paths to reach external targets.

3. Control-Plane Probing & Verification Inside the quarantine VRF, automated control-plane scripts fire active L3/L4 probes across the /20 space. If a dormant R.A.B.I.D.S variant or rogue AI wakes up and attempts to establish a session, it triggers immediate policy filters. The automated system instantly slaps the 65000:666 blackhole community tag back onto the prefix, dropping the subnet back into Null 0.

4. Prefix Squeezing: Forcing AIs into Smaller Subnets If the subnet passes verification, Netwatch re-adds the clean prefix to the safe global BGP table and updates border egress filters.

By pulling verified /24 or /20 subnets out of the massive blackholed /8 blocks, Netwatch progressively carves away clean CIDR space.

# Original State: Massive aggregated blackhole covering 10.0.0.0/8
ip route 10.0.0.0 255.0.0.0 Null0

# Reclaimed State: 10.10.0.0/16 is proven safe and routed normally.
# The remaining infected space is squeezed into tighter, specific blackhole routes:
ip route 10.0.0.0 255.240.0.0 Null0      # 10.0.0.0/12 still blackholed
ip route 10.32.0.0 255.224.0.0 Null0     # 10.32.0.0/11 still blackholed

This strategy doesn’t kill the rogue AIs or delete the viruses. Instead, it systematically shrinks their operational surface area. As Netwatch carves away clean CIDR blocks, the rogue entities are squeezed into increasingly dense, isolated /24 dead zones with fewer and fewer L3 destinations to hop between. You reclaim the Old Net bit by bit—not with code-slashing netrunners, but with strict prefix filtering and routing table precision.

Conclusion

“Okay, that was interesting… but it is not like this will ever matter”

Won’t it? Every single day we edge closer and closer to General Intelligence. I have seen five articles from AI companies advertising their model “broke containment” this week alone. Do I think that we are going to see a containment breach of rogue AIs that go through the internet, ripping and tearing? I started that sentence planning to say no… Here’s the rub. When a virus (a biological one) propagates, it doesn’t kill instantly. It replicates in the host first, and then it attempts to kill. Lets assume that these frontier models will become more efficent and/or hardware will increase in power - it is not out of the question eventually an opus 4.8 strength ai could replicate onto a server, and slowly worm its way through the IPv4 range.

It only takes one runaway model with autonomous code execution, an unpatched zero-day, and a basic subnet scanner to turn a rogue process into a planetary-scale propagation loop.

When that happens, nobody is going to save us with a glowing red visual firewall or a slick Cyberdeck interface. Some poor, overworked network engineer is going to sit down at a terminal, open up their core router configs, and start dropping /8 blocks into Null 0 just to keep the lights on in the local hospital.

The Blackwall isn’t sci-fi magic. It’s the ultimate BGP emergency shutdown—and if we aren’t careful, it’s a white paper we might actually have to write.