Re: for folks tracking DDOS sources or reading the GRC attack log

[Jonathan Disher <jdisher () ipix com>]

On Sat, 23 Jun 2001, RJ Atkinson wrote:

>       24.0/8 is the "cable block".  ARIN normally allocates residential
> cable modem subnets out of this space.  Nearly all the cable operators
> have one slice or another from this block.  Nearly all North American
> cable modems users have address space in this block.  Cable modems
> themselves are nearly always numbered in 10.0/8.
>
>       For those who have read the GRC web site, note that 216.216.8.x 
> appears not to be a cable modem slice in any event.  ARIN reports 
> that this slice has been allocated to @Work, which is the commercial 
> IP lease-line business unit within Excite@Home.  Presence of a 
> *.home.net DNS entry does not mean the system is on any cable modem 
> network.  There are no 24.0/8 addresses listed in the log at
>       http://grc.com/dos/attacklog.htm

My ATT@Home cablemodem is in 65.12.95..0/24.

Cablemodems don't -HAVE- to be in net-24.

-j

-- 
-Jonathan Disher
-Sr. Systems and Network Engineer
-Internet Pictures Corporation, San Ramon, CA
-[v] (650) 280-4833 | [p] (877) 446-9311 | [e] jdisher () eng ipix com