At 12:20 PM 9/21/2001, Steve Cody wrote: >It has been my understanding that the Nimda probes to web servers were >always from nearby IP address blocks. Not always. The worm merely devotes much MORE of its efforts to nearby addresses. Nimda apparently makes very frequent attacks upon the local Class B, fewer upon the local Class A, and fewer still upon the rest of the Net. But it can attack any address. --Brett Glass ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Fri Sep 21 2001 - 13:35:42 PDT