nanog mailing list archives
Re: Fwd: Re: Code Red variants
From: Larry Rosenman <ler () lerctr org>
Date: Sun, 5 Aug 2001 10:39:30 -0500
* Marius Strom <marius () marius org> [010805 10:38]:
Odd thing: from a Sprint connected network, he seess the most attempts from Sprint's Class A. On my cable-modem connected box through Cox Internet, I see 248 out of 256 attempts coming from *.cox-internet.com. Does the new variant perhaps try to "stick to it's own domain"? I do see some non-localdomain stuff as well, so it's not 100% definite, and I can't say whether or not the providers are proactively filtering inbound to prevent other providers from getting in.
According to another post, it wants to stay in the same /8, /16, and /24. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 972-414-9812 E-Mail: ler () lerctr org US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
Current thread:
- Code Red variants Lou Katz (Aug 04)
- Re: Code Red variants Jeff Ogden (Aug 04)
- Code Red II measl (Aug 04)
- Re: Code Red II Stephen J. Wilcox (Aug 05)
- Re: Code Red variants Andrew Barros (Aug 04)
- Re: Code Red variants mike harrison (Aug 05)
- Code Red II measl (Aug 04)
- <Possible follow-ups>
- Fwd: Re: Code Red variants Jeff Ogden (Aug 05)
- Re: Fwd: Re: Code Red variants Marius Strom (Aug 05)
- Re: Fwd: Re: Code Red variants Larry Rosenman (Aug 05)
- Re: Fwd: Re: Code Red variants Marius Strom (Aug 05)
- Re: Code Red variants Jeff Ogden (Aug 04)