[Nottingham] NTL ip address ranges

[Tom Bird]

On Fri, 17 Oct 2003, Martin wrote:

> Just done a whois to blacklist all the ntl subscriber generated MS worms
> and I get:
>
>  >>>
> inetnum:      81.111.0.0 - 81.111.15.255
> route:        81.96.0.0/12

> Does whois really list only the ip addresses actually in use within an
> allocated block? Or is the "route:        81.96.0.0/12" overly broad?

RIPE rules say (iirc) that customer assignments of 4 or more IP addresses
taken from a chunk of PA space need their own little entry in the RIPE
database.  A leased line with say.. 32 addresses would get its own entry
whereas one with just one wouldn't.

NTL's /12 is a very big block, and they can use different bits for
different things as they see fit.  They don't even have to announce it as
one block, although it would seem that they do.  Generally speaking
though, blocking ports 135 to 139 (tcp and udp) from *everywhere* is a
good idea.

The subject of IP routing and so forth is much bigger than it'd seem at a
first glance, all kinds of fun with BGP and OSPF, different types of IP
space, different methods used by the RIR's... among other things.  Google
will bring up lots of relevant stuff.

hth :)

-- 
Tom