There have been a number of threads on all of the version.bind queries flying around on the net. As most people who read this list know, this activity is generally attributed to worms. I while back, I posted some statistics showing the dramatic increase in version.bind queries that I have seen coming in to the networks I monitor. I just wanted to send out an update and see if anyone else out there has interesting data. I would expect similar trends from everywhere on the Internet. To me, the worm scanning looks pretty random. The first attached plot (a PNG file produced with Grace-5.1.2 (aka XmGrace)) shows the number of version.bind queries coming into my networks per day per IP address. That is, I have normalized the number of queries with respect to the number of IP addresses routed past the monitoring devices. One large spike is present when someone walked a large chunk of net sequentially (it would be possible to extract that and concentrate on just worm-like scans, but well, I didn't feel like it). Note that the date labels, which go by week, are from Tuesday to Tuesday. I like Grace, but the heck if I could convince it to move the major tick labels to Sundays. The second plot shows the number of packets from apparent sources. Only the top 50 source sources are shown. There are many more, 554 to be exact. I did not examine them all, but except for the number one entry at 1058 queries, the ones I checked showed worm-like behavior, random IPs queried at random times over several days or weeks, as opposed to scans, quick walks across IP ranges. I don't recall this list's policy on attachments, but PNGs are just a graphic format that most browsers support, IIRC. GIFs have patent issues and JPEGs are not really suited for this type of pic. -- Crist J. Clark Network Security Engineer crist.clarkat_private Globalstar, L.P. (408) 933-4387 FAX: (408) 933-4926 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact postmasterat_private
This archive was generated by hypermail 2b30 : Tue Jun 05 2001 - 15:30:39 PDT
