[Nottingham] NTL ip address ranges

[Dan Mackdermott]

Hi Martin,

On Fri, 17 Oct 2003, Martin wrote:

> Just done a whois to blacklist all the ntl subscriber generated MS worms 
> and I get:
> 
>  >>>
> inetnum:      81.111.0.0 - 81.111.15.255
> netname:      NTL
> descr:        NTL Infrastructure - Waltham Park
> country:      GB
> admin-c:      NNMC1-RIPE
> tech-c:       NNMC1-RIPE
> status:       ASSIGNED PA
> mnt-by:       AS5089-MNT
> remarks:      INFRA-AW
> changed:      hostmaster at ntli.net 20030512
> source:       RIPE
> 
> route:        81.96.0.0/12
> descr:        NTL-UK-IP-BLOCK
> origin:       AS5089
> mnt-by:       AS5089-MNT
> changed:      hostmaster at ntli.net 20020614
> source:       RIPE
>  >>>
> 
> Blacklisting 81.96.0.0/12 works very well in ignoring 99% of the crap. 
> The route spec gives NTL's block as 81.96.0.0 - 81.127.255.255...
> 
> So why the "inetnum:      81.111.0.0 - 81.111.15.255"?
> 
> Does whois really list only the ip addresses actually in use within an 
> allocated block? Or is the "route:        81.96.0.0/12" overly broad?

Is is for the trustees of blocks to declare what blocks have been 
allocated where.  In NTL's instance, multiple queries result in the 
following:

inetnum:      81.96.0.0 - 81.96.15.255
descr:        NTL Standalone CM - Hersham

inetnum:      81.96.16.0 - 81.96.63.255
descr:        NTL Standalone CM - Cosham

...

inetnum:      81.111.32.0 - 81.111.47.255
descr:        NTL Infrastructure - Nottingham

...etc...

It allows anyone to identify, within a reasonably geographic manner, the 
source of any problems.

NTL have a large infrastructure and they will have to have identified 
their need for such a large subnet to RIPE before it would have been 
allocated.  Due to the shortage of netblocks, they would have to submitted 
a detailed planned network infrastructure from the outset.

Since the issue is with the NTL network as opposed to a small portion, it 
is possibly reasonable to block out the entire /12 subnet...

Cheers,

Dan

-- 
Dan Mackdermott (Director)
InputLink Consulting Ltd
http://www.inputlink.net
t: +44 (0)115 988 1700
m: +44 (0)7980 711 557