On Sat, Jun 15, 2002 at 12:01:02PM +0200, wolfgangat_private wrote: > Nimda attack. Key differences are apparently: > - First request is always a GET for /galaxy_XXXXX.XXXX > - the nimda-ish requests that follow are actually not GET but HEAD > - there are a few (GET-)requests for /NULL.printer, NULL.ida and NULL.idq > thrown in as well. Cool; this kind of clarity in descriptions makes it very easy to see what is and isn't relevant in the data set. I'd agree that this is Nimda-ish, but not Nimda, and probably not what Tina was seeing, either. Has anyone else seen these traits in a scan using directory traversal exploits? -- Sweth. -- Sweth Chandramouli Idiopathic Systems Consulting svcat_private http://www.idiopathic.net/ --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Wed Jun 19 2002 - 09:41:15 PDT