In article <T_2dnfkjJNX0coXfRVn-uQ.DeleteThis@comcast.com>, Eric wrote:
>Moe Trin wrote:
>
>> Let's take Korea as a starting point. These are the zone files from the
>> first of the month.
>
> How (or where) did you get the gz'd data ?
It's a distillation off the zone files from the RIRs. Try <a style='text-decoration: underline;' href="http://ftp.arin.net" target="_blank">ftp.arin.net</a> in
/pub/stats/*/ - the files you are looking at are fairly large (the four
files total about 4.5 Megs - be warned). The files will look something
like this:
[compton ~]$ head IP.ADDR/stats/lacnic.20030817
1|lacnic|20030817|1858|?|2003-08-17|?
lacnic|*|ipv4|*|1044|*|summary
lacnic|*|asn|*|814|*|summary
lacnic|CL|ipv4|24.152.0.0|32768|2000-04-11|allocated
lacnic|AR|ipv4|24.232.0.0|65536|1997-06-02|allocated
lacnic|TT|ipv4|64.28.128.0|4096|2000-01-11|assigned
lacnic|AR|ipv4|66.60.0.0|16384|2000-12-26|allocated
lacnic|CO|ipv4|66.128.32.0|4096|2001-06-04|allocated
lacnic|CO|ipv4|66.231.64.0|4096|1970-01-01|allocated
lacnic|VE|ipv4|129.90.0.0|65536|1987-09-05|assigned
[compton ~]$
(That's from an older posting - the filenames are in the form
"delegated-$RIR-datestring" where $RIR is 'apnic', 'arin' 'lacnic' and
'ripencc', and the datestring is similar [year month day] to as shown
above.) I pass these files through a rather lengthy shell script to
extract the country code, IP starting address, the field that follows
(above 32768, 65536, 4096, and so on, which is the decimal width of the
assignment) for those lines in the files that contain the string 'ipv4'
(the file also has IPv6 data and ASN numbers which are not needed here).
The script then converts those decimal values into normal masks IF POSSIBLE.
These are routing masks, and they don't have to be binary values - see
RFC1519. The result is the four files that contain about 66,000 block
assignments.
I've lost track of it, but there is a perl module you might find on CPAN
that may also be useful, as it has recent data digested into a more
readable format. Googling for 'perl' and 'IP list' should turn it up.
The zone files _could_ be updated several times a local workday for all
I know, but downloading monthly might be overkill, as the data doesn't
seem to change very often.
On Sun, 20 Feb 2005 08:41:37 -0800, you added:
>blackholes.us does the trick
>and Moe, I'm thinking though what you wrote
You really want to think about how much of an effect this form of blocklist
would have on your firewall. EVERY packet is going to have to traverse all
the rules until it either passes, fails or falls out the bottom. That can
be a few CPU cycles. While Korea has 334 assignments (Taiwan 314, Hong Kong
544, China 778, India 323, and so on), some may be consolidated into larger
listings...
[compton ~]$ zgrep -Ec 'KR 211\.(1[6-9]|2[0-5])[0-9]' IP.ADDR/stats/APNIC.gz
40
[compton ~]$
What that is saying is that there are 40 assignments in the block 211.160.x.x
to 211.255.x.x for Korea, but actually looking at the data reveals that
Korea CURRENTLY has all the space between 211.168.0.0 and 211.255.255.255,
and if you understand CIDR, you can convert that into a /21, and a /20 and
a /18 rule - or three rules instead of 40.
On the other hand, maybe it might be easier to whitelist certain address
ranges (for example, pass 202.173.128.0 - 202.173.191.255 which is a block
assigned to an ISP in OZ), and then block 200.0.0.0/6 to wipe off everyone
else. Remember, it takes time to look through all the firewall rules
before deciding to pass/reject a packet.
Old guy<!-- ~MESSAGE_AFTER~ -->
>> Stay informed about: IP mappings 
FAQ
Profile
Private Messages
Log in
