nanog mailing list archives
Re: Code Red on dial-in ppp
From: Chris Adams <cmadams () hiwaay net>
Date: Sat, 21 Jul 2001 13:09:06 -0500
Once upon a time, Jason A. Mills <phyxis () rottweiler org> said:
I'm not sure I see why a POTS PPP link, or some other slow(er) on demand link might stop CodeRed. The first-pass payload is under 4096 bytes including framing, not exactly something you need a lot of low-latency bandwidth to push through. :-/
I don't think the issue is bandwidth. The issue is that the reports being sent out say such-and-such IP is infected without giving a time stamp (I got one of the reports as well). Without the time of the attack, the IP address is absolutely useless, as a hundred users may have had that IP in the last couple of days. In my case, out of two dozen hosts reported, all but two were dialup or DSL IPs, making the report mostly worthless without times. I don't mean to criticize, because obviously some folks put in a lot of effort, and it is useful information (especially if you don't have dialup hosts). Just in my case (at least), it wasn't much help. Interesting to note that the one host from our IP space that hit one of our servers was NOT in the report I received. We had over 21,000 hosts try this on our (Unix/Apache) web servers. Is someone collecting logs to generate reports? -- Chris Adams <cmadams () hiwaay net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.
Current thread:
- Code Red on dial-in ppp Mitch Halmu (Jul 21)
- Re: Code Red on dial-in ppp Jason A. Mills (Jul 21)
- Re: Code Red on dial-in ppp Mitch Halmu (Jul 21)
- Re: Code Red on dial-in ppp up (Jul 21)
- Re: Code Red on dial-in ppp Damon M. Conway (Jul 21)
- Re: Code Red on dial-in ppp Chris Adams (Jul 21)
- Re: Code Red on dial-in ppp John Kristoff (Jul 21)
- Re: Code Red on dial-in ppp Keith Woodworth (Jul 21)
- Re: Code Red on dial-in ppp Mitch Halmu (Jul 21)
- Code Red seemingly on firewall (Re: Code Red on dial-in ppp) E.B. Dreger (Jul 21)
- Re: Code Red on dial-in ppp Jason A. Mills (Jul 21)