Whois 172/12
Jon Lewis
jlewis at lewis.org
Sun Jan 15 13:54:34 UTC 2012
On Sun, 15 Jan 2012 bmanning at vacation.karoshi.com wrote:
> so as a stylistic point, 172/12 is supposed to equal 172.0.0.0/12?
Yeah...it's pretty common to drop the zeros when talkind CIDR.
> if memory serves, back in the day, there were records of allocations in this space,
> pre-ARIN. When RFC 1918 was settled on, there were some folks blocking 172.0.0.0/8
> so there was talk of relocating those folks into other space.
AOL has and uses (publicly) a bunch of space in 172/8. In fact, looking
at a BGP table, I'd say they're by far the largest user (one of the only)
in that /8.
For the OP...that scan traffic coming from 172.0.1.216 could be locally
generated, or could be coming from the internet, either from someone
announcing it briefly, or from a leaky NAT (just because it's not rfc1918
space doesn't mean someone didn't pick it out of their nether regions as
the "private network" for some NAT'd network).
There are resources where you can check to see if 172.0.1/24 or larger
networks have been announced recently (left as an exercise for the
reader). If it hasn't, then the "scans" probably aren't being very
effective since there can be no reply.
----------------------------------------------------------------------
Jon Lewis, MCP :) | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
More information about the NANOG
mailing list