PDA

View Full Version : Reading NTL IP Lookup data

ITGuyFromWales
30-08-2005, 23:27
Does anyone know how to read the result from a NTL IP Address Lookup.

What I have is SIMULAR to this:

cpc3-neat2-6-0-cust200.swan.cable.ntl.com

I am guessing it is a client based in Swansea obviously on NTL Cable but what does the preceeding data signify?

Any help Thanks.

:confused:
Chris W
31-08-2005, 00:51
actually it is someone in/near neath ;)

In order...
first part: the group of address from which it comes... i can't remember what there are, but there are different codes for registered/ unregistered, and a few pools... you may see cpc2, cpc3, cpc4 etc as fully registered ips
second part: the UBR (Universal Broadband Router)- in this case Neath 2
third part: Which cable on the UBR the person is connected two. There are 6 cables on each UBR [although sometimes not all of them are used]
fourth part: upstream channel id... 6 upstream channels on each cable... (or is it 7 :confused:)
next part: customer number... not related to anything at all... just a number
last part... self explanatory ;)

btw just out of interest, why do you want to know??
Paul
31-08-2005, 01:29
actually it is someone in/near neath ;)

In order...
first part: the group of address from which it comes... i can't remember what there are, but there are different codes for registered/ unregistered, and a few pools... you may see cpc2, cpc3, cpc4 etc as fully registered ips
second part: the UBR (Universal Broadband Router)- in this case Neath 2
third part: Which cable on the UBR the person is connected two. There are 6 cables on each UBR [although sometimes not all of them are used]
fourth part: upstream channel id... 6 upstream channels on each cable... (or is it 7 :confused:)
next part: customer number... not related to anything at all... just a number
last part... self explanatory ;)

btw just out of interest, why do you want to know??cpc1 etc defines which of the ubr's ip ranges they are on (the first three parts, for example 81.1.2.x) and the cust number (like cust200) is the final part of the ip (making like 81.1.2.200 in the example).
carlingman
31-08-2005, 02:54
Does anyone know how to read the result from a NTL IP Address Lookup.

What I have is SIMULAR to this:

cpc3-neat2-6-0-cust200.swan.cable.ntl.com

I am guessing it is a client based in Swansea obviously on NTL Cable but what does the preceeding data signify?

Any help Thanks.

:confused:


swan.cable.ntl is the Swansea core router location
neat2-6-0 is the cable 6 on ubr 2 in the abbreviation of neat = neath
cust200 - shows the adress within the subnet which is the same as the end part of the users ip address i.e. .200

Probably if you are getting firewall alerts from this it is an unaware user with a trojan on their PC.

Edit as above much what I have said and others and I will learn to read others post before copy and pasting an earlier typed up reply.

:D
BBKing
31-08-2005, 08:17
cpc3- = Cable modem PC range
neat2- = Neath UBR 2
6-0- = Card 6/0
cust200. Customer IP address number 200 in the range
swan. = Swansea DHCP servers
cable. = Cable Modem domain
ntl. = ntl
com = company

Don't assume it's always going to look like that, in case you're writing some script or other.

:P

There are 6 cables on each UBR

Up to eight now, actually. The new cards are a lot denser and you can get two in the space you could get one before (when you could get four in, not six). Hmm, that's not very clear. Basically you'll now see e.g. 2-6-0 and 2-6-1, which represent the two 'halves' of a physical card, each of which is a cable card in its own right.
ITGuyFromWales
01-09-2005, 15:31
Many Thanks for All your replies.

To be honest its the NEATH bit I wanted to confirm.

I run a website and continually receive PORN posts to my guestbook from the IP address I traced to this address.

Many Thanks For All Your Wisdom!!
Chris
01-09-2005, 15:37
Many Thanks for All your replies.

To be honest its the NEATH bit I wanted to confirm.

I run a website and continually receive PORN posts to my guestbook from the IP address I traced to this address.

Many Thanks For All Your Wisdom!!

As Carlingman already said, this is more likely due to that PC being infected with a trojan than the user deliberately spamming your website with pr0n.