Re: A watched pot never boils: The Return of Code Red

[Simon Waters <Simon () wretched demon co uk>]

> After eight hours of Code Red II, I haven't seen any impact.  So far
> the only website I can't reach is WWW.KEYNOTE.COM  Everything else
> seems to be humming along just fine.

Funny I get KEYNOTE.COM fine, but www.internethealthreport.com
has problems.

The site is reachable via http://internetpulse.com/ but Keynote
seem to use the other name in their link.

It is a DNS delegation issue (and possibly web server
configuration), I have flagged it to the contact listed in the
SOA at Keynote.

A quick glance suggests at the Internet Pulse suggests that
things may be slightly below average, but not dramatically
different from normal, certainly it doesn't look fatal yet.

The CAIDA Code Red figures quoted elsewhere suggest it may level
off at about half as many infections as last time. But we don't
really know what living with this thing for another 19 days will
be like.

My /24 *8-) didn't see any probes till about 80,000 unique hosts
had been detected at www.incidents.org, so I suspect the "pseudo
random" approach to IP addresses may lead to a long tail in the
infection.