RE: OT: Oddity with CRII

[Erek Adams <erek () theadamsfamily net>]

On Tue, 7 Aug 2001, Mark Spieth wrote:

> Erek, We monitor some 70 firewalls and see the same thing, some servers
> are hit repeatedly and some only once in a while. The worm is random as
> too the IP addresses it chooses to hit. For more information about the
> worm look at

One persion suggested that that box might be a NAT/Firewall and there a large
amount of IIS boxen behind it.

> http://aris.securityfocus.com/alerts/codered2/010805-Analysis-CodeRedII.
> pdf

I'll try to get a browser out thru the firewall/proxy setup here and have a
read.

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users