Re: Whois 172/12

[Alex Ryu <r.hyunseog () ieee org>]

As far as I know, 172.0.1.216 is not assigned, yet.

whois -h whois.arin.net 172.0.1.216
[whois.arin.net]
#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 172.0.1.216"
#
# Use "?" to get help.
#

No match found for 172.0.1.216.



#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

Also, when you check BGP routing table, it is not routed at all.

route-server.as3257.net>sh ip bgp 172.0.1.216
% Network not in table
route-server.as3257.net>

So it seems like forged IP address.

Alex


On Sun, Jan 15, 2012 at 1:37 AM, Ted Fischer <ted () fred net> wrote:
> Hi all,
>
>   Tearing what's left of my hair out.
>
>   A customer is getting scanned by a host claiming to be "172.0.1.216".
>
>   I know this is bogus, but I want to go back to the customer with as
> much authoritative umph as I can (heaven forbid they just take my
> word).
>
>   I'm pretty sure I read somewhere once that 172/12 was "reserved" or
> something like that.  All I can find now is that 172/8 is "administered by
> ARIN".  Lots of information on 172.16/12, but not a peep about
> 172/12.
>
>   If anybody could provide some insight as to the
> allocation/non-allocation of this block, it would be much appreciated.
>
>   Thanks.
>
> Ted Fischer