[RFCI-Discuss] whois records with single ip address (CIDR aaa.bbb.ccc.ddd/32)

[Bruce Campbell]

On Wed, 9 Oct 2002, egor duda wrote:

> Wednesday, 09 October, 2002 you wrote:
>
> RJ> At 14:53 +0400 on 2002-10-09, egor duda wrote:
> >> The problem, however, is the following. The CIDR of this whois record
> >> is aaa.bbb.ccc.ddd/32. Other addresses (taken in random) in
> >> 218.234.58.O/24 network have the same contact information, so spam

The KRNIC database entries are not describing a /32.  It would seem that
anything in 218.234.58.128/25 has not been assigned by HANANET further
down, or that HANANET has not contacted KRNIC to have the KRNIC database
updated.  The information remaining in the KRNIC output is the Org info
for 218.234/15 and 218.236/14 .

Unfortunately, the KRNIC database doesn't mention that its the Org details
for the parent range (and what that range is), and you need to go to the
RIR database (whois.apnic.net) to find out.

Compare the KRNIC output of 218.234.58.125 with 218.234.58.129:

	query: 218.234.58.125

	# ENGLISH

	KRNIC is not ISP but National Internet Registry similar with APNIC.
	Please see the following end-user contacts for IP address information.

	IP Address         : 218.234.58.0-218.234.58.127
	Network Name       : HANANET-HIGHBAN-SORINE
	Connect ISP Name   : HANANET
	Connect Date       : 20020710
	Registration Date  : 20020710

	[ Organization Information ]
	Orgnization ID     : ORG251888
	Org Name           : SORINE INTERNET

(etc)

-------------

	query: 218.234.58.129

	# ENGLISH

	KRNIC is not ISP but National Internet Registry similar with APNIC.
	The IP address is allocated and still held by the following ISP, or
	they did not update whois information after assigning to end-user.

	Please see the following ISP contacts for relevant information
	or network abuse complaints.

	[ ISP Organization Information ]
	Org Name      : Hanaro Telecom Inc.
	Service Name  : HANANET

Note that the IP range is, unfortunately, unspecified.  This does not
entail that it is a /32 .

So you've got two problems, being:

	a) HANANET haven't updated the KRNIC database (if you're receiving
	   crap from 218.234.58.128/25
	b) The KRNIC database doesn't supply parent IP ranges (odd, I'd
	   swear that they used to).

Neither of which, on its own, warrants an ipwhois listing.

-- 
                             Bruce Campbell                            RIPE
                   Systems/Network Engineer                             NCC
                 www.ripe.net - PGP562C8B1B             Operations/Security