Re: Worm probes

[Joe Abley <jabley () automagic org>]

On Tue, Sep 18, 2001 at 11:05:35AM -0400, up () 3 am wrote:
> ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k
> box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this
> time of day, although still well short of capacity...apache server
> processor load is WAY up just from the requests, and the logs are growing
> like mad.

I'm sitting behind a dialup box right now, and I just added a log
clause to an ipf rule matching connection attempts to port 80.

I'm averaging 35 probes per minute. Blocking them is quite beneficial
to performance on a v.34 connection :)


Joe