[38951] in North American Network Operators' Group
Re: for folks tracking DDOS sources or reading the GRC attack log
daemon@ATHENA.MIT.EDU (Richard A. Steenbergen)
Sat Jun 23 22:30:15 2001
Date: Sat, 23 Jun 2001 22:29:51 -0400 (EDT)
From: "Richard A. Steenbergen" <ras@e-gerbil.net>
To: RJ Atkinson <rja@inet.org>
Cc: nanog@merit.edu
Message-ID: <Pine.BSF.4.21.0106232226170.29677-100000@overlord.e-gerbil.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Errors-To: owner-nanog-outgoing@merit.edu
On Sat, Jun 23, 2001 at 10:18:10PM -0400, RJ Atkinson wrote:
>
> 24.0/8 is the "cable block". ARIN normally allocates residential
> cable modem subnets out of this space. Nearly all the cable operators
> have one slice or another from this block. Nearly all North American
> cable modems users have address space in this block. Cable modems
> themselves are nearly always numbered in 10.0/8.
>
> For those who have read the GRC web site, note that 216.216.8.x
> appears not to be a cable modem slice in any event. ARIN reports
> that this slice has been allocated to @Work, which is the commercial
> IP lease-line business unit within Excite@Home. Presence of a
> *.home.net DNS entry does not mean the system is on any cable modem
> network. There are no 24.0/8 addresses listed in the log at
> http://grc.com/dos/attacklog.htm
> so it isn't clear to me that any cable modems were used in that
> particular attack.
AFAIK 24/8 is exausted. My cable modem is numbered out of 65.4.208.0/19,
and the announcement for this block is 65.0.0.0/13.
--
Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras
PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)
