Ronald, On Wed, 2011-03-09 at 04:06 -0800, Ronald F. Guilmette wrote:
In message <1299668193.2210.12.camel@shane-desktop>, you wrote:
Ronald,
On Tue, 2011-03-08 at 20:45 -0800, Ronald F. Guilmette wrote:
I posted lists of IP addresses and domain names within several ``RIPE'' IP address blocks that I allege have been handed over for use by American bulk e-mail advertising companies. (If you no longer have that e-mail or those lists I will be happy to re-send them to you.)
Looking at the first IP address in your list:
So you didn't bother to check any of the other blocks, correct?
Well, you challenged Leo to pick one, so I did just that. Admittedly I didn't pick one out of the middle. But you sent a list of over 4000 IP addresses, surely you didn't think I would check them all?
What does traceroute to, e.g., 178.215.176.99 indicate to you?
I'm not an expert in these things, so please do tell me what YOU think.
Looks like it's going out of New York. If you look at the last couple hops, we see: . . . 9. xe-1-1-0.er1.lga5.us.above.n 0.0% 10 84.5 88.1 84.4 114.5 9.3 10. 209.249.75.160 0.0% 10 85.3 85.1 84.1 86.3 0.8 11. ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 12. 178.215.176.99 10.0% 10 153.8 156.3 153.8 158.1 1.4 We see that it seems to be coming from 209.249.75.160. That appears in the ARIN database as NET-209-249-75-0-1, which has the following customer information: CustName: UNIVERSAL WEB DESIGN Address: 320 7th Ave, Suite 134 City: Brooklyn StateProv: NY PostalCode: 00000 Country: US RegDate: 2004-03-23 Updated: 2004-03-23 Ref: http://whois.arin.net/rest/customer/C00789085 So, my guess would be that the Ukrainian holder of this PI block decided to have it hosted by an American company. That seems just as legitimate as a Russian company providing services to an American company. That's what *I* think. I realize you're not an expert, but there may be some training available from someone if you do want to become an expert in these things. I think most of the RIRs have courses that they give to law enforcement officials to help figure out the dispositions of various address blocks. Maybe one of them would be willing to make some slide decks public?
AFAIK there have never been rules about who you can provide services to with the address blocks you have been given. I would object strongly to a proposal to do so.
Someone suggested that there already exists a policy to the effect that providing IP block without also providing connectivity is a no-no.
Or did I misunderstand that?
You did misunderstand that. As I understand it, you can request IP space if you either are an LIR or can find an LIR to request a PI block for you, and you have a need for it. This need might be providing connectivity, but it could also be web hosting, or video delivery, or download farms, or research networks, or a million other purposes that may or may not have been invented yet. What the other poster was suggesting is that the actual usage did not match the documented usage. That is a "no-no", and I think what Suresh was trying to make easier to identify with his proposal about making the "descr:" more explicit. -- Shane