[Nottingham] NTL ip address ranges

[Martin]

Paul Sladen wrote:
> On Fri, 17 Oct 2003, Martin wrote:
> 
> Hello Martin,
> 
>> Just done a whois to blacklist all the ntl subscriber generated MS
>> worms inetnum:      81.111.0.0 - 81.111.15.255 descr:        NTL
>> Infrastructure - Waltham Park
>> 
>> route:        81.96.0.0/12 descr:        NTL-UK-IP-BLOCK 
>> Blacklisting 81.96.0.0/12 works very well in ignoring 99% of the
>> crap.
> 
> 
> Please don't black-hole 1/4,000th's of the entire Internet in one go
> without understanding what you are doing.  Particular when virtually
> all of those addresses are guaranteed to be in the UK

If they are MS-worm infected scum, then a blacklist is _far_ too good 
for 'em... Could try force-feeding them some 'education', or extra 
awareness...


> --they are
> addresses that you are statistically-more-likely to be wanting to
> access!

Now... That was the question. I didn't really believe that the full 
range could be just for home subscribers...


> To take a ["random"] example:
> 
> 81.109.162.0/24
> 
> was recently assigned to Proweb Ltd--an ISP based in Nottingham.

Takes a quick look-see...

...except that:
www.proweb.net.         86290   IN      A       195.182.164.17

they're not on ntl!
(Yet? (;-))

[...]
> Some of that address-space is assigned to MS-worm generating idiots.
> Most of it isn't.  One of those ``Isn't'', is me.  Another is
> yourself (judging by the email-headers).  And I'll not even
> mentioning the other 1,048,574...
> 
> -Paul

Oooer... I'm touched... I'll have to specially 'whitelist' that block...


And yep, I'm one of the ntl scum. The 'blacklist' is just the Shorewall 
blacklist that quietly drops the incoming stuff. Being as ntl are 
inconsiderate enough to mix the residential and business ip stuff 
together, looks like I'll have to be blacklisting just the residential 
blocks I get hammered by.


Thanks for the extra info.

Cheers,
Martin

-- 
----------------
Martin Lomas
martin at ml1.co.uk
----------------