for folks tracking DDOS sources or reading the GRC attack log
24.0/8 is the "cable block". ARIN normally allocates residential cable modem subnets out of this space. Nearly all the cable operators have one slice or another from this block. Nearly all North American cable modems users have address space in this block. Cable modems themselves are nearly always numbered in 10.0/8. For those who have read the GRC web site, note that 216.216.8.x appears not to be a cable modem slice in any event. ARIN reports that this slice has been allocated to @Work, which is the commercial IP lease-line business unit within Excite@Home. Presence of a *.home.net DNS entry does not mean the system is on any cable modem network. There are no 24.0/8 addresses listed in the log at http://grc.com/dos/attacklog.htm so it isn't clear to me that any cable modems were used in that particular attack. Ran rja@inet.org
On Sat, 23 Jun 2001, RJ Atkinson wrote:
24.0/8 is the "cable block". ARIN normally allocates residential cable modem subnets out of this space. Nearly all the cable operators have one slice or another from this block. Nearly all North American cable modems users have address space in this block. Cable modems themselves are nearly always numbered in 10.0/8.
For those who have read the GRC web site, note that 216.216.8.x appears not to be a cable modem slice in any event. ARIN reports that this slice has been allocated to @Work, which is the commercial IP lease-line business unit within Excite@Home. Presence of a *.home.net DNS entry does not mean the system is on any cable modem network. There are no 24.0/8 addresses listed in the log at http://grc.com/dos/attacklog.htm
My ATT@Home cablemodem is in 65.12.95..0/24. Cablemodems don't -HAVE- to be in net-24. -j -- -Jonathan Disher -Sr. Systems and Network Engineer -Internet Pictures Corporation, San Ramon, CA -[v] (650) 280-4833 | [p] (877) 446-9311 | [e] jdisher@eng.ipix.com
At 21:47 24/06/01, Jonathan Disher wrote:
Cablemodems don't -HAVE- to be in net-24.
North American cable modems DID have to be in 24/8 until that became fully allocated. It is also the only block that was fully allocated to cable modem users. Outside North America there hasn't been, AFAIK, any special allocation for cable modem networks. Ran
Once can go no farther than this: Some cable modems tend to be in /24.
On Sat, 23 Jun 2001 22:18:10 -0400 RJ Atkinson wrote:
24.0/8 is the "cable block". ARIN normally allocates residential cable modem subnets out of this space. Nearly all the cable operators have one slice or another from this block. Nearly all North American cable modems users have address space in this block. Cable modems themselves are nearly always numbered in 10.0/8.
Perhaps "a cable modem block"? We tell ARIN we need networks for cable modems and have never gotten an allocation from this block. regards, fletcher
At 21:59 24/06/01, Fletcher E Kittredge wrote:
On Sat, 23 Jun 2001 22:18:10 -0400 RJ Atkinson wrote:
24.0/8 is the "cable block". ARIN normally allocates residential cable modem subnets out of this space. Nearly all the cable operators have one slice or another from this block. Nearly all North American cable modems users have address space in this block. Cable modems themselves are nearly always numbered in 10.0/8.
Perhaps "a cable modem block"? We tell ARIN we need networks for cable modems and have never gotten an allocation from this block.
No, "The Cable Block" is correct parlance. Jon Postel himself designated it as such in the mid/late 90s. It is the only block that consists *entirely* of cable modem allocations. However, you must have been late to the party. 24/8 appears (not certain) to be fully allocated, so later allocations seem to be coming from other address blocks. Ran
24.0/8 is the "cable block".
No it's not. Check out 24.132/14 for instance.
ARIN normally allocates residential cable modem subnets out of this space.
No they don't. Large parts of 24/8 are allocated to RIPE or APNIC. ARIN has no say in how those blocks are used.
Nearly all the cable operators have one slice or another from this block.
Perhaps this is true in the US.
Nearly all North American cable modems users have address space in this block.
No they don't.
Cable modems themselves are nearly always numbered in 10.0/8.
No they aren't.
For those who have read the GRC web site, note that 216.216.8.x appears not to be a cable modem slice in any event.
Let's see, hmmmm..... lots of Windows PCs, and ports 137-139 are universally filtered across the whole /24. Smells like cable to me.
ARIN reports that this slice has been allocated to @Work, which is the commercial IP lease-line business unit within Excite@Home.
That is correct.
Presence of a *.home.net DNS entry does not mean the system is on any cable modem network.
That is also correct. Thank you Dr. Obvious.
There are no 24.0/8 addresses listed in the log at http://grc.com/dos/attacklog.htm so it isn't clear to me that any cable modems were used in that particular attack.
Not surprising, given your impressive slate of incorrect assumptions.
Ran rja@inet.org
Didja ever have a bad hair day, when you just felt like being contrary for the hell of it?
participants (5)
-
Daniel Karrenberg -
Fletcher E Kittredge -
Jonathan Disher -
Mike Batchelor -
RJ Atkinson