RE: shout out 4 ...

["Ferris, Robin" <R.Ferris () napier ac uk>]

Thanks for that. I've got a lot of useful info as regards the way this worm
used the network. has any one been able to work out why it goes quiet for
periods of time. I thought it might have been whilst it was replicating but
was not sure. Also does any one know why it seems to scan a single subnet
over and over again? like its stuck in a loop or something?
 
TIA
 
RF

-----Original Message-----
From: John.Airey () rnib org uk [mailto:John.Airey () rnib org uk]
Sent: 24 September 2003 13:33
To: R.Ferris () napier ac uk
Subject: RE: [Full-disclosure] shout out 4 ...


I've seen a short log where Nachia is sending out ICMP packets at the rate
of 100 per second. Is this any use?
- 
John Airey, BSc (Jt Hons), CNA, RHCE 
Internet systems support officer, ITCSD, Royal National Institute of the
Blind, 
Bakewell Road, Peterborough PE2 6XU, 
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey () rnib org uk 

How is it that some people have strongly held beliefs on the contents of the
Bible and the Origin of Species without having read either?

-----Original Message-----
From: Ferris, Robin [mailto:R.Ferris () napier ac uk]
Sent: 23 September 2003 12:18
To: full-disclosure () lists netsys com
Subject: [Full-disclosure] shout out 4 ...


Hi
 
im looking for a detailed sniffer analysis of nachia, I had watched theinfo
flow through this list when it first appeared. However some one has just
asked for some help but specifically from the detailed network sniffer side
of things. 
 
Things like packet sizes, frequency of scans, scan pattersn etc etc
 
TIA
 
RF


- 


NOTICE: The information contained in this email and any attachments is 

confidential and may be legally privileged. If you are not the 

intended recipient you are hereby notified that you must not use, 

disclose, distribute, copy, print or rely on this email's content. If 

you are not the intended recipient, please notify the sender 

immediately and then delete the email and any attachments from your 

system.


RNIB has made strenuous efforts to ensure that emails and any 

attachments generated by its staff are free from viruses. However, it 

cannot accept any responsibility for any viruses which are 

transmitted. We therefore recommend you scan all attachments.


Please note that the statements and views expressed in this email 

and any attachments are those of the author and do not necessarily 

represent those of RNIB.


RNIB Registered Charity Number: 226227


Website: http://www.rnib.org.uk