nanog mailing list archives

Re: Code Red Hammering Away


From: <michael () aplatform com>
Date: Sat, 4 Aug 2001 14:03:01 -0700 (PDT)


Bob,

I guess they will get around to me as I dont show any XXX.  Only a hundred
or so NNNN.

Michael...


On Sat, 4 Aug 2001, Bob K wrote:


N's versus X's on a server with a block of 5 IP's as of August 1, 4AM EDT:

4:53:42pm|melange@host:/home/melange> grep default.ida /var/log/httpd-access.log | grep NNNNN|wc -l
     436
4:53:48pm|melange@host:/home/melange> grep default.ida /var/log/httpd-access.log | grep XXXXX | wc -l
       6

On Sat, 4 Aug 2001 michael () aplatform com wrote:


Hello,

Very interesting.  Im seeing the NNNNNNNNNNNNNNNNNNNN's as it was in July.

Michael...

On Sat, 4 Aug 2001, Gregory (Grisha) Trubetskoy wrote:



I also noticed requests that use "XXXXXXXXX" instead of "NNNNNNNNNN". In
fact I see more X's than N's as of this morning.

Grisha

On Sat, 4 Aug 2001, Lou Katz wrote:


My little Class C seems to be getting 3-6 attempts per second to
connect to Port 80 on various IPs at the present time. Is this
about average?

-=[L]=-





--
Bob <melange () yip org> | Yes.  I know.  That is, indeed, *not* mayonnaise.



Current thread: