Re: Whois 172/12

2012-01-19 Thread Tom Hill
On Sun, 2012-01-15 at 14:05 +0530, Suresh Ramasubramanian wrote: Jesus. 172.16/12 fine .. that's rfc1918. The rest of 172/8 is mostly unallocated. And for almost all of it, there is Team Cymru: show ip route 172.0.0.0 Routing entry for 172.0.0.0/9, supernet Known via bgp, distance 20,

Re: Whois 172/12

2012-01-15 Thread Leigh Porter
On 15 Jan 2012, at 07:39, Ted Fischer t...@fred.net wrote: Hi all, Tearing what's left of my hair out. A customer is getting scanned by a host claiming to be 172.0.1.216. I know this is bogus, but I want to go back to the customer with as much authoritative umph as I can (heaven

Re: Whois 172/12

2012-01-15 Thread Ted Fischer
Thanks for the replies so far, but not what I was looking for. I should have specified that I've done several ns dig lookups just to make sure. We were supposed to have lit up the last of IPv4 last year. I would have presumed that meant that there was nothing left. Since I can't find a

Re: Whois 172/12

2012-01-15 Thread Suresh Ramasubramanian
Jesus. 172.16/12 fine .. that's rfc1918. The rest of 172/8 is mostly unallocated. On Sun, Jan 15, 2012 at 1:28 PM, Patrick W. Gilmore patr...@ianai.net wrote: Read RFC1918. Likely a machine on his local network (i.e. behind the same NAT box) is hitting him. But that is not guaranteed.  A

Re: Whois 172/12

2012-01-15 Thread Robert Bonomi
From nanog-bounces+bonomi=mail.r-bonomi@nanog.org Sun Jan 15 02:02:00 2012 Subject: Re: Whois 172/12 From: Patrick W. Gilmore patr...@ianai.net Date: Sun, 15 Jan 2012 02:58:11 -0500 To: NANOG list nanog@nanog.org Read RFC1918. Likely a machine on his local network (i.e. behind

Re: Whois 172/12

2012-01-15 Thread bmanning
On Sun, Jan 15, 2012 at 06:36:12AM -0600, Robert Bonomi wrote: From nanog-bounces+bonomi=mail.r-bonomi@nanog.org Sun Jan 15 02:02:00 2012 Subject: Re: Whois 172/12 From: Patrick W. Gilmore patr...@ianai.net Date: Sun, 15 Jan 2012 02:58:11 -0500 To: NANOG list nanog@nanog.org

Re: Whois 172/12

2012-01-15 Thread Jon Lewis
On Sun, 15 Jan 2012 bmann...@vacation.karoshi.com wrote: so as a stylistic point, 172/12 is supposed to equal 172.0.0.0/12? Yeah...it's pretty common to drop the zeros when talkind CIDR. if memory serves, back in the day, there were records of allocations in this space,

Re: Whois 172/12

2012-01-15 Thread Patrick W. Gilmore
On Jan 15, 2012, at 7:36 AM, Robert Bonomi wrote: I'v read RFC-1918. I cannot find *any* reference to 172.0/12, as the OP was asking about. 172.16/12, yes. but not 172.0/12. Can you please clarify your advice? My advice is not to post when you are tired. :) -- TTFN, patrick

Re: Whois 172/12

2012-01-15 Thread Alex Ryu
Subject: Re: Whois 172/12 From: Patrick W. Gilmore patr...@ianai.net Date: Sun, 15 Jan 2012 02:58:11 -0500 To: NANOG list nanog@nanog.org Read RFC1918. Likely a machine on his local network (i.e. behind the same NAT box) is hitting him. Patrick,   I'v read RFC-1918.   I cannot

RE: Whois 172/12

2012-01-15 Thread Network IP Dog
. Gilmore Cc: NANOG list Subject: Re: Whois 172/12 Jesus. 172.16/12 fine .. that's rfc1918. The rest of 172/8 is mostly unallocated. On Sun, Jan 15, 2012 at 1:28 PM, Patrick W. Gilmore patr...@ianai.net wrote: Read RFC1918. Likely a machine on his local network (i.e. behind the same NAT box

Re: Whois 172/12

2012-01-15 Thread Suresh Ramasubramanian
So kind, compassionate and forgiving that I'll buy Patrick a beer when I see him next, its been a long time. --srs On Sun, Jan 15, 2012 at 9:46 PM, Network IP Dog network.ip...@gmail.com wrote: quoteJesus. 172.16/12 fine .. that's rfc1918.   The rest of 172/8 is mostly unallocated./quote

Re: Whois 172/12

2012-01-15 Thread Jay Moran
On Sun, Jan 15, 2012 at 8:54 AM, Jon Lewis jle...@lewis.org wrote: AOL has and uses (publicly) a bunch of space in 172/8. In fact, looking at a BGP table, I'd say they're by far the largest user (one of the only) in that /8. We, AOL, have 172.128/10, 172.192/12, 172.208/13, 172.216/16.

RE: Whois 172/12

2012-01-15 Thread Keith Medcalf
- From: Ted Fischer [mailto:t...@fred.net] Sent: Sunday, 15 January, 2012 01:20 To: nanog@nanog.org Subject: Re: Whois 172/12 Thanks for the replies so far, but not what I was looking for. I should have specified that I've done several ns dig lookups just to make sure. We were supposed

Re: Whois 172/12

2012-01-15 Thread Justin M. Streiner
On Sun, 15 Jan 2012, Ted Fischer wrote: Thanks for the replies so far, but not what I was looking for. I should have specified that I've done several ns dig lookups just to make sure. We were supposed to have lit up the last of IPv4 last year. I would have presumed that meant that there was

Re: Whois 172/12

2012-01-14 Thread Alex Ryu
As far as I know, 172.0.1.216 is not assigned, yet. whois -h whois.arin.net 172.0.1.216 [whois.arin.net] # # Query terms are ambiguous. The query is assumed to be: # n 172.0.1.216 # # Use ? to get help. # No match found for 172.0.1.216. # # ARIN WHOIS data and services are subject to the

Re: Whois 172/12

2012-01-14 Thread Patrick W. Gilmore
Read RFC1918. Likely a machine on his local network (i.e. behind the same NAT box) is hitting him. But that is not guaranteed. A packet with a source address of 172.0.x.x could be hitting his machine. Depends on how well you filter. Many networks only look at destination IP address, source