[Nottingham] NTL ip address ranges

[Martin]

Just done a whois to blacklist all the ntl subscriber generated MS worms 
and I get:

 >>>
inetnum:      81.111.0.0 - 81.111.15.255
netname:      NTL
descr:        NTL Infrastructure - Waltham Park
country:      GB
admin-c:      NNMC1-RIPE
tech-c:       NNMC1-RIPE
status:       ASSIGNED PA
mnt-by:       AS5089-MNT
remarks:      INFRA-AW
changed:      hostmaster at ntli.net 20030512
source:       RIPE

route:        81.96.0.0/12
descr:        NTL-UK-IP-BLOCK
origin:       AS5089
mnt-by:       AS5089-MNT
changed:      hostmaster at ntli.net 20020614
source:       RIPE
 >>>

Blacklisting 81.96.0.0/12 works very well in ignoring 99% of the crap. 
The route spec gives NTL's block as 81.96.0.0 - 81.127.255.255...

So why the "inetnum:      81.111.0.0 - 81.111.15.255"?

Does whois really list only the ip addresses actually in use within an 
allocated block? Or is the "route:        81.96.0.0/12" overly broad?


Regards,
Martin

-- 
----------------
Martin Lomas
martin at ml1.co.uk
----------------