Re: Code Red gone to sleep?

From: Andreas Östling (andreasoat_private)
Date: Wed Oct 03 2001 - 10:11:44 PDT

Next message: Michael Clark: "NEW FILES: Scan of the Month - October"

Previous message: cambriaat_private: "Re: Code Red gone to sleep?"
In reply to: cambriaat_private: "Re: Code Red gone to sleep?"
Next in thread: hvdkooijat_private: "Re: Code Red gone to sleep?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wednesday 03 October 2001 01.33, cambriaat_private wrote:
> CR's 10/1 exit was predicted by some of the analyses of CR.

It went to sleep alright, and it was on time.
In case someone is interested, here is a simple graph showing number of 
SYN packets/sec going to port 80 around Oct 1, on a network that had a 
machine infected by CRII (local time is UTC+2).
ftp://ftp.su.se/pub/users/andreas/CRII_oct_1st.jpg

/Andreas

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Michael Clark: "NEW FILES: Scan of the Month - October"
Previous message: cambriaat_private: "Re: Code Red gone to sleep?"
In reply to: cambriaat_private: "Re: Code Red gone to sleep?"
Next in thread: hvdkooijat_private: "Re: Code Red gone to sleep?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Oct 03 2001 - 10:17:28 PDT