[Nottingham] NTL ip address ranges

[Martin]

Dan Mackdermott wrote:
> On Fri, 17 Oct 2003, Martin wrote:
> 
>>Just done a whois to blacklist all the ntl subscriber generated MS worms 
>>and I get:
[...]
>>Blacklisting 81.96.0.0/12 works very well in ignoring 99% of the crap. 
>>The route spec gives NTL's block as 81.96.0.0 - 81.127.255.255...
>>
>>So why the "inetnum:      81.111.0.0 - 81.111.15.255"?
>>
>>Does whois really list only the ip addresses actually in use within an 
>>allocated block? Or is the "route:        81.96.0.0/12" overly broad?
> 
> 
> Is is for the trustees of blocks to declare what blocks have been 
> allocated where.  In NTL's instance, multiple queries result in the 
> following:
> 
> inetnum:      81.96.0.0 - 81.96.15.255
> descr:        NTL Standalone CM - Hersham
> 
> inetnum:      81.96.16.0 - 81.96.63.255
> descr:        NTL Standalone CM - Cosham
> 
> ...
> 
> inetnum:      81.111.32.0 - 81.111.47.255
> descr:        NTL Infrastructure - Nottingham
> 
> ...etc...
> 
> It allows anyone to identify, within a reasonably geographic manner, the 
> source of any problems.
> 
> NTL have a large infrastructure and they will have to have identified 
> their need for such a large subnet to RIPE before it would have been 
> allocated.  Due to the shortage of netblocks, they would have to submitted 
> a detailed planned network infrastructure from the outset.
> 
> Since the issue is with the NTL network as opposed to a small portion, it 
> is possibly reasonable to block out the entire /12 subnet...



Thanks, good answer. The /12 subnet gets it!

Certainly radically slowed down my logs expansion. And I thought things 
had been quietning down.

I doubt I'll be losing anything unless someone keen has set up their own 
home-based web server.

Thanks,
Martin


-- 
----------------
Martin Lomas
martin at ml1.co.uk
----------------