[SLUG] ARIN (64.12.24.44)

2002-05-20 Thread Nick Croft 

Morning,

Using `etherape' on the lan, I notice a large number of probes from
64.12.0.0/16 which would appear to be the American Registry of Internet 
Numbers.

Is this usual, or spoofing perhaps?

Nick
-- 
SLUG - Sydney Linux User's Group - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug

Re: [SLUG] ARIN (64.12.24.44)

2002-05-20 Thread Zhasper 

I don't know what whois tool/server you're seeing, but it's only telling
half teh story..

[jpolley@queen jpolley]$ whois -h whois.geektools.com 64.12.24.44
[whois.geektools.com]
Query: 64.12.24.44
Registry:  whois.arin.net
Results:
America Online, Inc. (NETBLK-AOL-MTC)
   10600 Infantry Ridge Road
   Manassas, VA 20109
   US

   Netname: AOL-MTC
   Netblock: 64.12.0.0 - 64.12.255.255

   Coordinator:
  America Online, Inc.  (AOL-NOC-ARIN)  [EMAIL PROTECTED]
  703-265-4670

   Domain System inverse mapping provided by:

   DNS-01.NS.AOL.COM152.163.159.232
   DNS-02.NS.AOL.COM205.188.157.232

   Record last updated on 16-Dec-1999.
   Database last updated on  19-May-2002 19:58:40 EDT.


Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.

Whatever you're doing is saying that that block is controlled by ARIN -
but, checking with ARIN's servers reveals that they've assigned that block
to AOL

Use gekktools's proxy...

On Tue, 21 May 2002, Nick Croft wrote:

 Morning,

 Using `etherape' on the lan, I notice a large number of probes from
 64.12.0.0/16 which would appear to be the American Registry of Internet
 Numbers.

 Is this usual, or spoofing perhaps?

 Nick


-- 
SLUG - Sydney Linux User's Group - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug

Re: [SLUG] ARIN (64.12.24.44)

2002-05-20 Thread Nick Croft 

* Zhasper ([EMAIL PROTECTED]) wrote:
 I don't know what whois tool/server you're seeing, but it's only telling
 half teh story..
 
Silly me, not using whois on it. I looked up a security book list of
addresses. (Ziegler).

Plain vanilla whois, without -h, gave the same result, but with an
addition:

  The ARIN Registration Services Host contains ONLY Internet
  Network Information: Networks, ASN's, and related POC's.
  Please use the whois server at rs.internic.net for DOMAIN related
  Information and whois.nic.mil for NIPRNET Information.

Thanks,

Nick

-- 
SLUG - Sydney Linux User's Group - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug