for folks tracking DDOS sources or reading the GRC attack log

Mailman List Mirror (Read Only)
1

24.0/8 is the "cable block". ARIN normally allocates residential
cable modem subnets out of this space. Nearly all the cable operators
have one slice or another from this block. Nearly all North American
cable modems users have address space in this block. Cable modems
themselves are nearly always numbered in 10.0/8.

  For those who have read the GRC web site, note that 216.216.8.x
appears not to be a cable modem slice in any event. ARIN reports
that this slice has been allocated to @Work, which is the commercial
IP lease-line business unit within Excite@Home. Presence of a
*.home.net DNS entry does not mean the system is on any cable modem
network. There are no 24.0/8 addresses listed in the log at
  http://grc.com/dos/attacklog.htm
so it isn't clear to me that any cable modems were used in that
particular attack.

Ran
rja@inet.org

2

My ATT@Home cablemodem is in 65.12.95..0/24.

Cablemodems don't -HAVE- to be in net-24.

-j

3

North American cable modems DID have to be in 24/8
until that became fully allocated. It is also the only block
that was fully allocated to cable modem users. Outside
North America there hasn't been, AFAIK, any special allocation
for cable modem networks.

Ran

4

Once can go no farther than this: Some cable modems tend to be in /24.

5

  24.0/8 is the "cable block".

No it's not. Check out 24.132/14 for instance.

ARIN normally allocates residential
cable modem subnets out of this space.

No they don't. Large parts of 24/8 are allocated to RIPE or APNIC. ARIN
has no say in how those blocks are used.

Nearly all the cable operators
have one slice or another from this block.

Perhaps this is true in the US.

Nearly all North American
cable modems users have address space in this block.

No they don't.

Cable modems
themselves are nearly always numbered in 10.0/8.

No they aren't.

  For those who have read the GRC web site, note that 216.216.8.x
appears not to be a cable modem slice in any event.

Let's see, hmmmm..... lots of Windows PCs, and ports 137-139 are universally
filtered across the whole /24. Smells like cable to me.

ARIN reports
that this slice has been allocated to @Work, which is the commercial
IP lease-line business unit within Excite@Home.

That is correct.

Presence of a
*.home.net DNS entry does not mean the system is on any cable modem
network.

That is also correct. Thank you Dr. Obvious.

There are no 24.0/8 addresses listed in the log at
  http://grc.com/dos/attacklog.htm
so it isn't clear to me that any cable modems were used in that
particular attack.

Not surprising, given your impressive slate of incorrect assumptions.

Ran
rja@inet.org

Didja ever have a bad hair day, when you just felt like being contrary for
the hell of it?