IP allocations / bogon - verification

Fri Aug 2 20:04:01 UTC 2013

On 8/2/13 9:22 PM, Leo Vegoda wrote:
> On 2 Aug 2013, at 12:09, Marcel Plug <marcelplug at gmail.com> wrote:
>
>> On Fri, Aug 2, 2013 at 2:28 PM, Leo Vegoda <leo.vegoda at icann.org> wrote:
>>
>> But I'd be fascinated - if somewhat disturbed - to be proved wrong...
>>
>> Team Cymru seems to think it was a Bogon, as recently as yesterday.
>> http://www.cymru.com/BGP/bogons.html  (search for 66.185.0.0/20, last seen Aug 1st)
>>
>> Probably the networks of the "financial related websites" were blocking due to the Cymru Bogons list.
> It is possible that it ended up on TC's Bogons list because the prefix was listed as reserved by ARIN in:
>
> ftp://ftp.arin.net/pub/stats/arin/delegated-arin-extended-20130730
> ftp://ftp.arin.net/pub/stats/arin/delegated-arin-extended-20130731
> ftp://ftp.arin.net/pub/stats/arin/delegated-arin-extended-20130801
> ftp://ftp.arin.net/pub/stats/arin/delegated-arin-extended-20130802
>
> I have not checked back further than 30 July.
RIPEstat shows the prefix was "withdrawn" from ARIN delegated stats on 
the 8 of July

https://stat.ripe.net/widget/allocation-history#w.resource=66.185.0.0%2F20

It came reappeared as 'allocated' yesterday, 2013-08-01
>
> It definitely shows as allocated here in whois, so I'm confused by the mismatch.
there is a mismatch between the normal and extended ARIN stats:

$ cd ftp/pub/stats/arin
$ grep 66.185.0.0 delegated-arin-*20130802
delegated-arin-20130802:arin|US|ipv4|66.185.0.0|4096|20011026|allocated
delegated-arin-extended-20130802:arin||ipv4|66.185.0.0|4096||reserved|


-- Rene

>
> Regards,
>
> Leo