[42579] in North American Network Operators' Group
Re: Worm probes
daemon@ATHENA.MIT.EDU (Daniel Senie)
Tue Sep 18 10:28:33 2001
Message-Id: <5.1.0.14.2.20010918102214.040aa300@mail.amaranth.net>
Date: Tue, 18 Sep 2001 10:25:51 -0400
To: sigma@pair.com, nanog@merit.edu
From: Daniel Senie <dts@senie.com>
In-Reply-To: <20010918135431.27315.qmail@smx.pair.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Errors-To: owner-nanog-outgoing@merit.edu
At 09:54 AM 9/18/01, sigma@pair.com wrote:
>Has anyone else been seeing a dramatic increase in /scripts/.. NT worm
>probes this morning? We're seeing about 8000/second, starting around 9:15
>Eastern time, to and from a wide variety of addresses.
>
>Is CodeRed or one of its relatives scheduled to start sweeping again today?
>We've never seen this level of traffic related to the NT worms. Even
>though we don't run any NT at all, we still have to suffer :(
First ones appeared today, and so far I see 17650 attempts on just one of
my servers. We don't run any Microsoft stuff either, but that doesn't keep
our servers from getting hammered...
-----------------------------------------------------------------
Daniel Senie dts@senie.com
Amaranth Networks Inc. http://www.amaranth.com
