[RFCI-Discuss] whois records with single ip address (CIDR aaa.bbb.ccc.ddd/32)

[egor duda]

Hi!

Wednesday, 09 October, 2002 you wrote:

DJB> On Wednesday, October 9, 2002, at 01:47  PM, egor duda wrote:
>> Formally speaking, a list of 128 results of whois queries to KRNIC for
>> addresses in /25 network, all of them containing security@hanaro.com,
>> and a single bounce from this address is, i suppose, valid evidence.
>> Yet it's clearly not practical, neither for reporter, nor (more
>> important) for RBL maintainer.

DJB> We do "reverse-aggregation" (e.g., 192.168.0.0-192.168.2.255 = 
DJB> 192.168.0.0/23,192.168.2.0/24), I don't see why we couldn't have, in 
DJB> the evidence portion "entries for n.n.n.X-n.n.n.Y are the same, making 
DJB> n.n.n.X/MM listable".

Such evidence is hard to verify, isn't it? If every query in
n.n.n.X-n.n.n.Y range returns information without parent range, it
takes Y-X+1 queries for both submitter and maintainer to check if all
addresses in X-Y range really have identical entries.

Egor.                                           mailto:deo@logos-m.ru