RE: What use is the NIPC?

From: Tim Hollebeek (thollebeekat_private)
Date: Mon Aug 06 2001 - 11:36:55 PDT

Next message: Alfred Huger: "Re: disinfection tool"

Previous message: Srdjan Nikolic: "RE: CodeRedII attempts from Cable/DSL/dial-ups"
Maybe in reply to: aleph1at_private: "What use is the NIPC?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> 	As an aside, I too am seeing a large upswing in CR 
> probes; many of
> which are repeated by the same IPs.  Additionally, CRv2 is now
> outnumbering CRv1 probes by 2:1.

I'm seeing a 100:1 ratio today on a cable modem ... mostly from other
cable modems.

Total CRv2:            482
Total CRv1:              5
CRv2 from !24. *.*.*:    3
CRv2 from  24.!x.*.*:  159
CRv2 from  24. x.*.*:  320       (x = my subnet)

Tim Hollebeek
Research Scientist
Cigital Labs

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Alfred Huger: "Re: disinfection tool"
Previous message: Srdjan Nikolic: "RE: CodeRedII attempts from Cable/DSL/dial-ups"
Maybe in reply to: aleph1at_private: "What use is the NIPC?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Aug 06 2001 - 12:28:49 PDT