Re: FW: CodeRed Observations.

From: Russell Fulton (r.fultonat_private)
Date: Thu Mar 13 2003 - 11:02:08 PST

  • Next message: Micha³ Rogala: "RE: CodeRed Observations."

    On Thu, 2003-03-13 at 13:48, larosa, vjay wrote:
    > > 
    > > I find it awfully strange that there is no handshake (not even a single
    > > SYN to try and establish
    > > a session) but these packets show up anyway. I also am not seeing an
    > > increase of port 80
    > > scans in my firewall logs or with any of my IDS sensors. Is anybody else
    > > out there seeing the 
    > > same things we are?
    
    I seem to remember seeing the same thing when the original CR II was
    around.  
    
    -- 
    Russell Fulton, Computer and Network Security Officer
    The University of Auckland,  New Zealand
    
    "It aint necessarily so"  - Gershwin
    
    
    ----------------------------------------------------------------------------
    
    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
    



    This archive was generated by hypermail 2b30 : Thu Mar 13 2003 - 14:37:22 PST