[Nottingham] NTL ip address ranges

[Paul Sladen]

On Fri, 17 Oct 2003, Martin wrote:

Hello Martin,

> Just done a whois to blacklist all the ntl subscriber generated MS worms 
> inetnum:      81.111.0.0 - 81.111.15.255
> descr:        NTL Infrastructure - Waltham Park
>
> route:        81.96.0.0/12
> descr:        NTL-UK-IP-BLOCK
> Blacklisting 81.96.0.0/12 works very well in ignoring 99% of the crap.

Please don't black-hole 1/4,000th's of the entire Internet in one go without
understanding what you are doing.  Particular when virtually all of those
addresses are guaranteed to be in the UK--they are addresses that you are
statistically-more-likely to be wanting to access!

To take a ["random"] example:

  81.109.162.0/24

was recently assigned to Proweb Ltd--an ISP based in Nottingham.  Have a
look yourself:

  whois -h whois.ripe.net -- '-T inetnum,route -M 81.96.0.0/12' | less -S

> Does whois really list only the ip addresses actually in use within an 
> allocated block? Or is the "route:        81.96.0.0/12" overly broad?

Yes.  It is /very/ overly broad.  NTL are a Very Large ISP in the UK with
huge amounts of IP-space.  For efficiency reasons, NTL are allocated space
in chunks as-large-as-possible.

Some of that address-space is assigned to MS-worm generating idiots.  Most
of it isn't.  One of those ``Isn't'', is me.  Another is yourself (judging
by the email-headers).  And I'll not even mentioning the other 1,048,574...

	-Paul
-- 
War is inconsistent with Truth.  Nottingham, GB