Re: Timing of DoS and Intrusion attempts.

From: Valdis.Kletnieksat_private
Date: Tue May 29 2001 - 07:17:25 PDT

Next message: Michael Clark: "UDP scan from DNS server?"

Previous message: Jonathan Bloomquist: "Re: Scanning from a "intruder.rs88.net"?"
In reply to: Patrick Andry: "Timing of DoS and Intrusion attempts."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, 28 May 2001 10:48:17 EDT, Patrick Andry <pandryat_private>  said:
> 	Assuming we can find some form of correlation between the time of
> the attack on both the target computer and the source computer, the possible

Remember to remove automated tools from your correlation.  A *large* percentage
of the hacking activity these days seems to be various worms and automated
scanners, which can be doing their work even while the perpetrator is asleep
or otherwise engaged...


-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

application/pgp-signature attachment: stored

Next message: Michael Clark: "UDP scan from DNS server?"
Previous message: Jonathan Bloomquist: "Re: Scanning from a "intruder.rs88.net"?"
In reply to: Patrick Andry: "Timing of DoS and Intrusion attempts."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue May 29 2001 - 17:50:31 PDT