Re: [logs] nimda web server logs

From: Tina Bird (tbird@precision-guesswork.com)
Date: Tue Jun 11 2002 - 17:16:52 PDT

Next message: John Swope: "Re: [logs] strange udp packets"

Previous message: Nate Campi: "Re: [logs] nimda web server logs"
In reply to: Nate Campi: "Re: [logs] nimda web server logs"
Next in thread: Sweth Chandramouli: "Re: [logs] nimda web server logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Thanks for the summary, Jay, and to everyone for the assistance.  Yes,
this was an excerpt of the entire "attack session"; there were earlier log
messages that looked like Nimda, but as Nate's pointed out, there are also
lots of reasons to think that a manual attack might look the same.  It
will be interesting to see what Incidents brings up.

But hey, I'm allowed to get the discussion started on my own list ;-) and
I did have log data...

t.


---------------------------------------------------------------------
To unsubscribe, e-mail: loganalysis-unsubscribeat_private
For additional commands, e-mail: loganalysis-helpat_private

Next message: John Swope: "Re: [logs] strange udp packets"
Previous message: Nate Campi: "Re: [logs] nimda web server logs"
In reply to: Nate Campi: "Re: [logs] nimda web server logs"
Next in thread: Sweth Chandramouli: "Re: [logs] nimda web server logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Jun 11 2002 - 17:17:50 PDT