[148412] in North American Network Operators' Group
Re: Whois 172/12
daemon@ATHENA.MIT.EDU (Alex Ryu)
Sun Jan 15 02:54:12 2012
In-Reply-To: <3bb23a18d74082eb94003592c718b9f4.squirrel@secure.xecu.net>
Date: Sun, 15 Jan 2012 01:53:17 -0600
From: Alex Ryu <r.hyunseog@ieee.org>
To: ted@fred.net
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
As far as I know, 172.0.1.216 is not assigned, yet.
whois -h whois.arin.net 172.0.1.216
[whois.arin.net]
#
# Query terms are ambiguous. The query is assumed to be:
# "n 172.0.1.216"
#
# Use "?" to get help.
#
No match found for 172.0.1.216.
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
Also, when you check BGP routing table, it is not routed at all.
route-server.as3257.net>sh ip bgp 172.0.1.216
% Network not in table
route-server.as3257.net>
So it seems like forged IP address.
Alex
On Sun, Jan 15, 2012 at 1:37 AM, Ted Fischer <ted@fred.net> wrote:
> Hi all,
>
> =A0 Tearing what's left of my hair out.
>
> =A0 A customer is getting scanned by a host claiming to be "172.0.1.216".
>
> =A0 I know this is bogus, but I want to go back to the customer with as
> much authoritative umph as I can (heaven forbid they just take my
> word).
>
> =A0 I'm pretty sure I read somewhere once that 172/12 was "reserved" or
> something like that. =A0All I can find now is that 172/8 is "administered=
by
> ARIN". =A0Lots of information on 172.16/12, but not a peep about
> 172/12.
>
> =A0 If anybody could provide some insight as to the
> allocation/non-allocation of this block, it would be much appreciated.
>
> =A0 Thanks.
>
> Ted Fischer
>
>
>
>
>
>
>
