nanog mailing list archives
Re: Code Red growth stats
From: Ryan Tucker <rtucker () netacc net>
Date: Wed, 1 Aug 2001 23:17:38 -0400
On Wednesday, August 1, 2001, at 10:35 , Steven M. Bellovin wrote:
If it has indeed turned up again, I'm at a loss to explain it. While I'm sure there are some IIS servers on home machines, I doubt there are that many. But I don't have another explanation to offer.
I monitored a couple web servers for probes today... out of a good 20 or so probes, only 1 looked like a legitimate server. I don't have the data here to do a complete analysis, but the single largest group of infected machines were behind ADSL. Cable and dialup (!) were also well-represented.
It looks like a lot of servers got patched (given an equal number of average servers and average home connections, I'd expect more probes from the servers due to home connections usually having crippled upstreams), but now we're down mostly home machines, which much of the press coverage said were not a problem.
I also noticed probes dropped off suddenly after about 4:30pm EDT (2030 GMT). It went from about 5 per hour to one the rest of the evening. Gratuitous arping dropped off about that time as well.
These observations are only valid to about 8pm or so... got bored and went home. -rt
Current thread:
- Re: Code Red growth stats, (continued)
- Re: Code Red growth stats k claffy (Aug 01)
- RE: Code Red growth stats Joe Blanchard (Aug 01)
- Re: Code Red growth stats Steven M. Bellovin (Aug 01)
- Re: Code Red growth stats Jasper Wallace (Aug 01)
- Re: Code Red growth stats Larry Rosenman (Aug 01)
- Re: Code Red growth stats Jasper Wallace (Aug 01)
- RE: Code Red growth stats Paul Lantinga (Aug 01)
- Re: Code Red growth stats Steven M. Bellovin (Aug 01)
- Re: Code Red growth stats Dave Stewart (Aug 01)
- Re: Code Red growth stats Daniel Senie (Aug 02)
- Re: Code Red growth stats Greg A. Woods (Aug 01)
- Re: Code Red growth stats Ryan Tucker (Aug 01)
- Re: Code Red growth stats k claffy (Aug 01)
- Re: Code Red growth stats Kevin Houle (Aug 02)
- Re: Code Red growth stats Dave Stewart (Aug 01)
- RE: Code Red growth stats Roeland Meyer (Aug 01)
- Re: Code Red growth stats Steven M. Bellovin (Aug 01)
- Re: Code Red growth stats Etaoin Shrdlu (Aug 01)
- RE: Code Red growth stats Roeland Meyer (Aug 01)
- Re: Code Red growth stats Adam Rothschild (Aug 01)
- Re: Code Red growth stats Avi Freedman (Aug 01)
- Re: Code Red growth stats k claffy (Aug 01)
- Re: Code Red growth stats Valdis . Kletnieks (Aug 01)
- Re: Code Red growth stats k claffy (Aug 01)
(Thread continues...)