[Android Q&A, Help & Troubleshooting] clonk:
I actually found this thread through a search after noticing the DoD IPs being assigned as temporary portals for Sprint's internal network on my Galaxy S7. Sprint, and apparently several other carriers, are definitely doing something that utilizes the DoD IP blocks. It could be that they are leasing the IP ranges from the government, perhaps because of the increasing demand for IPv4 addresses and their limited availability, or possibly because routing client devices through the DoD (or another similar network) as an end proxy point would gain benefit from the robust DDoS flood protection that military and certain other large networks enjoy. Just because a call taker at the DoD Network Information Center claims that their systems do not provide services to private corporations doesn't mean that it's not actually happening. Only the administrators of such a network would know for sure.

Admittedly there's the national security related surveillance (by DHS/NSA) possibility. But I'm not going to speculate on how likely that may or may not be as the correct answer.

I've been observing my S7's connection behavior relating to assignment of these mysterious DoD IP addresses. I'm going to share a few related things that I've noticed. To begin with, my S7 is not rooted. I'm using "IP Widget", a great little piece of software that's obtainable from the Play store. I have it set to display the current Sprint internal network IP as well as my device's external WAN IP. Both are continually visible on my home screen. This little widget does a fine job and is very quick to update when one of the IPs changes. When the DoD IPs temporarily appear within the widget's internal network field, it is always after I have toggled from wi-fi back to carrier network mode, OR after I have re-booted from a network reset. Other than that I never see them. Although I also use an app called "IP Track" and it logs many more of these DoD addresses that I don't see with the widget. With the widget, these DoD IPs only remain displayed for 30 to 45 seconds or so (seemingly during network initialization periods), after which the widget's internal network IP field reverts back to an unroutable internal network IP, such as 172.16.209.1. The last octet of these DoD IPs is

always

the same as the last octet of the device's external WAN IP. For example, if the device's WAN IP is 66.87.112.77 then the DoD IP will be something like 30.195.167.77 (the first three octets will change to different numerics from within the DoD IP address blocks, but the last octet will always be identical to that of the WAN IP - they are obviously paired). And since these mystery IPs are different each time and follow the WAN IP's last octet, they have obviously been assigned to a DHCP pool by someone and are leased dynamically from a DHCP server. And I should mention that the Sprint level 2 technical support folks I've spoken with, as well as their CTMS (ticket management specialist) people have pleaded ignorance about the existence and assignment of these mysterious IP connections.

Another interesting element is the fact that two of the /16 IP blocks that these mystery IPs emerge from (i.e., 51.197.0.0/16 and 51.198.0.0/16) are not owned by the DoD at all. Instead they are registered to the UK's Department for Work and Pensions in Warrington, Enland (UK-DWP). The rest, however, are all registered to DoD Network Information Center (DNIC) in Columbus, Ohio.

For what it's worth, I will include a list of the IP's that my S7 has automatically connected to within the past two weeks or so (minus the last octet):

30.195.167.xxx

30.199.214.xxx

28.146.166.xxx

51.198.150.xxx

29.198.21.xxx

21.15.212.xxx

21.14.115.xxx

51.197.183.xxx

21.12.255.xxx

51.197.139.xxx

51.198.88.xxx

51.198.178.xxx

51.197.94.xxx

29.194.29.xxx

29.211.227.xxx

28.147.127.xxx

11.197.142.xxx

29.195.90.xxx

None of these IPs has reverse DNS (PTR) records and traceroutes to them consistently stop with a "destination host unreachable" response after a few hops.

Here are a pair of example whois data records for both the the DNIC and UK-DWP IP blocks:

Network Whois record

Queried whois.arin.net with "n 29.194.29.116"...

NetRange: 29.0.0.0 - 29.255.255.255

CIDR: 29.0.0.0/8

NetName: DNIC-RNET-029-000

NetHandle: NET-29-0-0-0-1

Parent: ()

NetType: Direct Allocation

OriginAS:

Organization: DoD Network Information Center (DNIC)

RegDate: 1991-07-01

Updated: 2012-11-08

Ref: https://whois.arin.net/rest/net/NET-29-0-0-0-1

OrgName: DoD Network Information Center

OrgId: DNIC

Address: 3990 E. Broad Street

City: Columbus

StateProv: OH

PostalCode: 43218

Country: US

RegDate:

Updated: 2011-08-17

Ref: https://whois.arin.net/rest/org/DNIC

OrgTechHandle: MIL-HSTMST-ARIN

OrgTechName: Network DoD

OrgTechPhone: +1-844-347-2457

OrgTechEmail: disa.columbus.ns.mbx.hostmaster-dod-nic@mail.mil

OrgTechRef: https://whois.arin.net/rest/poc/MIL-HSTMST-ARIN

OrgAbuseHandle: REGIS10-ARIN

OrgAbuseName: Registration

OrgAbusePhone: +1-844-347-2457

OrgAbuseEmail: disa.columbus.ns.mbx.arin-registrations@mail.mil

OrgAbuseRef: https://whois.arin.net/rest/poc/REGIS10-ARIN

OrgTechHandle: REGIS10-ARIN

OrgTechName: Registration

OrgTechPhone: +1-844-347-2457

OrgTechEmail: disa.columbus.ns.mbx.arin-registrations@mail.mil

OrgTechRef: https://whois.arin.net/rest/poc/REGIS10-ARIN

Network Whois record

Queried whois.ripe.net with "-B 51.197.94.219"...

% Information related to '51.180.0.0 - 51.210.255.255'

% Abuse contact for '51.180.0.0 - 51.210.255.255' is 'peter.wightman@dwp.gsi.gov.uk'

inetnum: 51.180.0.0 - 51.210.255.255

netname: UK-DWP

country: GB

org: ORG-DFWA1-RIPE

admin-c: PW1754-RIPE

tech-c: PW1754-RIPE

status: LEGACY

mnt-by: RIPE-NCC-LEGACY-MNT

mnt-by: DWP-MNT

created: 2015-05-27T15:49:29Z

last-modified: 2016-04-14T08:22:52Z

source: RIPE

organisation: ORG-DFWA1-RIPE

org-name: Department for Work and Pensions

org-type: LIR

address: 301, Bridgewater Place, Birchwood Park

address: WA3 6XF

address: Warrington

address: UNITED KINGDOM

phone: +441925845368

e-mail: peter.wightman@dwp.gsi.gov.uk

admin-c: PW3858-RIPE

tech-c: PW3858-RIPE

abuse-c: AR32160-RIPE

mnt-ref: RIPE-NCC-HM-MNT

mnt-ref: DWP-MNT

mnt-by: RIPE-NCC-HM-MNT

mnt-by: DWP-MNT

created: 2015-05-15T08:37:12Z

last-modified: 2016-07-26T14:13:02Z

source: RIPE

person: Peter Wightman

address: 301 Bridgewater Place

Birchwood Park

Warrington

England

org: ORG-DWP1-RIPE

phone: +44 1925 845368

e-mail: peter.wightman@dwp.gsi.gov.uk

nic-hdl: PW1754-RIPE

mnt-by: DWP-MNT

created: 2009-01-06T10:13:40Z

last-modified: 2009-01-06T10:28:39Z

source: RIPE

% This query was served by the RIPE Database Query Service version 1.87.4 (DB-2)