Question on 7.0.0.0/8

Mon Apr 16 02:45:29 UTC 2007

On Sun, 15 Apr 2007, Jim Popovitch wrote:

> On Sun, 2007-04-15 at 22:58 +0100, michael.dillon at bt.com wrote:
>> As a result, most people consider William Leibzon and the Bogon project
>> to be, collectively, the authoritative source for information on whose
>> IP address that is. That's because William and the Bogon project, act
>> authoritative, and take some pains to provide comprehensive data.

Its not authoritative. IANA and ARIN should be authoritative unless
there are issues with their data as I for example raised. My project
should be considered research with a lot of practical use (but which
also with errors and bugs as with other research projects).

> I truly want to believe that, and I do appreciate the effort that Willam
> and Elan put into this.  That said, I do near-daily diffs between
> changes made to
> http://completewhois.com/bogons/data/data-bgp-announced/announced_bogon-cidr-all.txt
>
> Here are today's deletions from Friday's list, do bogons really change
> that frequently?
>
> 76.0.0.0/13
> 76.0.0.0/19

Its same glitch I mentioned before, which is not entirely fixed yet.
The data before was:
76.0.0.8/29
76.0.0.16/28
76.0.0.32/27
...
76.0.128.0/17
76.1.0.0/16
76.2.0.0/15
76.4.0.0/14

The correct entry is obviously 76.0.0.0/13

133/8 is special case because APNIC does not import this data in their whois.
Completewhois collection system does separate whois query to nic.ad.jp for 
each individual  /16 out of it to find which of the blocks are and are not 
allocated. There are issues when data is not received properly or when 
they change format; plus to that there is no 2nd way to correlate the data 
as for example between RIR whois and statistics data. JPNIC also at times 
does not respond so as a result of all this, I changed collection to run 
not once a day but once/week (this was done over year ago) and at times 
check data manually too. Last time this collection was run was run is Apr 
15th 4am which produced the following _correct_ list of bogons for 133/8
(this special data is at http://www.completewhois.com/bogons/data/jp/):
133.0.0.0/16
133.22.0.0/16
133.59.0.0/16
133.61.0.0/16
133.81.0.0/16
133.90.0.0/16
133.93.0.0/16
133.107.0.0/16
133.112.0.0/16
133.124.0.0/16
133.143.0.0/16
133.147.0.0/16
133.156.0.0/16
133.171.0.0/16
133.174.0.0/16
133.177.0.0/16
133.178.0.0/15
133.195.0.0/16
133.212.0.0/16
133.230.0.0/15
133.234.0.0/16
133.239.0.0/16
133.246.0.0/16

However previous days the data looked like this:

133.0.0.0/16
133.1.0.0/30
133.2.0.0/30
133.3.0.0/30
...

So in fact it was improperly listing first 4 ips of the each /16
(but not entire /16 as you printed). In actuallity its also exactly
the same bug just manifesting itself in different way due to how 
JPNIC collection is done.

> 193.33.178.0/23

inetnum:        193.33.178.0 - 193.33.179.255
netname:        NOWIRES-PI
descr:          No Wires Ltd
country:        GB
org:            ORG-NWL1-RIPE
admin-c:        AT4098-RIPE
tech-c:         JC2953-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-HM-PI-MNT
mnt-by:         CRYSTAL-MNT
mnt-lower:      RIPE-NCC-HM-PI-MNT
mnt-routes:     CRYSTAL-MNT
mnt-domains:    CRYSTAL-MNT
changed:        hostmaster at ripe.net 20070413
source:         RIPE

Unless I'm mistaken this is new PI allocation done 2 days ago. So
system worked as it should be removing it from the bogons list.

> I'm just trying to get a complete (not constantly changing) list of
> bogons.

The list changes and collection are done everyday on purpose as 
completewhois system produced data not on IANA bogons which change 
infrequently but more specific bogon data based on RIR allocations,
i.e. it tries to catch and list portions of blocks that IANA allocated
to RIR but RIR has not yet allocated/assigned to end-user or ISP.

As RIRs make allocations basicly every business day, completewhois
data is recollected to make sure it corresponds to most current data.

---

If you have further questions it maybe better to send them to me
privately and when I'll try to respond and check on the differences
if you find something significant.

Its also in my plans to write "bogon 2.0" system as I've learned quite
a bit about how things should and should not be done in the last 2-3
years so 2nd time around should be much better (and I'm also better
programmer as I switched from being operations network engineer who
did some programming on side to operations monitoring & other tools
programmer). When I get to this project (maybe over the summer), this
will include user web interface to see exactly what changes were done
each day and exactly why system added or removed particular block(s).

-- 
William Leibzon
Elan Networks
william at elan.net