Re: Code Red, anyone?

[Glenn Forbes Fleming Larratt <glratt () io com>]

Here at (unnamed-for-policy-reasons academic Class B) we've seen
exactly one packet matching our Snort rule for IIS exploit attempts of
the sort that include Code Red (from 195.219.102.44 in .de, FWIW).

We've also examined MRTG graphs of all our network and subnet links,
paying particular attention to the turnover of 0000 UTC 1 August, and
have observed no anomalies in traffic flows that would indicate either
widespread infection or DDoS attempts.

        -g

On Tue, 31 Jul 2001, Alfred Huger wrote:

> I realize that most of you have taken shelter and are awaiting the
> impending demise of the Internet as we know it. However for those of you
> stalwart bastions of courage who are still manning the ship in the face of
> this clear and present danger, I have a question. Anyone seeing Code Red
> activity yet?
-- 
Glenn Forbes Fleming Larratt         The Lab Ratt (not briggs :-)
glratt () io com                        http://www.io.com/~glratt
There are imaginary bugs to chase in heaven.


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com