Re: Nimda Probes Stopped

From: Stuart Staniford (stuartat_private)
Date: Tue Sep 18 2001 - 15:46:33 PDT

  • Next message: Greg Broiles: "possible early worm vector?"

    We're still seeing several probes per second into a /17, though the rate is
    noisy.  The probe rate is not going up any more - suggesting some degree of
    saturation.  Are you sure someone upstream of you didn't apply some filter?
    
    Stuart.
    
    Jason Giglio wrote:
    > 
    > Apparently the probes have stopped as quickly as they began, here at least,
    > around 2:30 Eastern time.
    > 
    > internettrafficreport.com is showing some recovery also.
    > 
    > Is this phase over now?  Makes one wonder what's next...
    > --
    > Jason Giglio
    > Information Technology Coordinator, Smyth Companies, Bedford VA
    > Phone: 540-586-2311x113
    > e-mail: jgiglioat_private
    > 
    > ----------------------------------------------------------------------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management
    > and tracking system please see: http://aris.securityfocus.com
    
    -- 
    Stuart Staniford     ---     President     ---     Silicon Defense
             ** Silicon Defense: Technical Support for Snort **
    mailto:stuartat_private  http://www.silicondefense.com/
    (707) 445-4355 x 16                           (707) 445-4222 (FAX)
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Sep 18 2001 - 16:08:44 PDT