Re: Whois 172/12

[Jimmy Hess <mysidia () gmail com>]

On Sun, Jan 15, 2012 at 2:20 AM, Ted Fischer <ted () fred net> wrote:

> We were supposed to have lit up the last of IPv4 last year.  I would have
> presumed that meant that there was nothing left.  Since I can't find a

Not a good assumption.   There remains IPv4 address space that has not yet
been assigned to any network,  but is available for assignment.    172/12
appears to likely fall into that category.

there are - supposedly - no fresh IPv4 addresses left to allocate, and the
> only reference to this block is that 172/8 is allocated to ARIN.  It
> doesn't even appear in RFC 5735.

Just because ARIN does not appear to have allocated networks from 172/12
yet does not mean this address space is unavailable, not part of the free
pool, or will not be allocated from by ARIN in the future.   Just a /12 is
a very small shard of IP address space.

This is also part of a legacy /8.

My question is about 172/12.  Where is it, what is it's supposed purpose.
>

This falls under IP addresses that can be assigned to networks but have not
yet been recorded as assigned to any networks.


> I'm almost sure it's an internal box.  I just find it better to give a
> professional answer to "why can't I use this" than just "you can't use

Only the RFC1918 IP address space is reserved for use by private networks.
172/12  is not reserved by RFC, therefore portions of it that are
unallocated could
be allocated at any time.

this and why is this address scanning you for udp/137 anyway".
>

Something is generating packets sourced with an IP address in that range
which should not be using that source IP address.

It could be a device misconfiguration, or it could be intentional IP
address spoofing.


> If someone can point out to me what was done with 172/12 I'd appreciate it.


--
-JH