24.0/8 is the "cable block". ARIN normally allocates residential cable modem subnets out of this space. Nearly all the cable operators have one slice or another from this block. Nearly all North American cable modems users have address space in this block. Cable modems themselves are nearly always numbered in 10.0/8. For those who have read the GRC web site, note that 216.216.8.x appears not to be a cable modem slice in any event. ARIN reports that this slice has been allocated to @Work, which is the commercial IP lease-line business unit within Excite@Home. Presence of a *.home.net DNS entry does not mean the system is on any cable modem network. There are no 24.0/8 addresses listed in the log at http://grc.com/dos/attacklog.htm so it isn't clear to me that any cable modems were used in that particular attack. Ran rja@inet.org