Re: Yet Another Nimda Thread (YANT)

["Mike Lewinski" <mike () rockynet com>]

> I heard there were a few reports of Nimda going completely quiet in
> certain netblocks, but none were substantiated.  I haven't seen a
> single Nimda IIS exploit attempt since a little before 10 AM (EST).

Perhaps your ISP has implemented NBAR.

If this is the case, you can look for the existence of many http
connections that never complete. This is the primary drawback to using
NBAR- a RST packet never gets sent even though the router has closed the
connection. I suspect Cisco will find a workaround for this soon.

See:
http://www.cisco.com/warp/public/cc/so/neso/ienesv/cxne/nbar_ov.htm

Mike




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com