Snort mailing list archives
RE: OT: Oddity with CRII
From: Ryan Russell <ryan () securityfocus com>
Date: Tue, 7 Aug 2001 10:12:35 -0600 (MDT)
On Tue, 7 Aug 2001, Mark Spieth wrote:
Erek, We monitor some 70 firewalls and see the same thing, some servers are hit repeatedly and some only once in a while. The worm is random as too the IP addresses it chooses to hit. For more information about the worm look at http://aris.securityfocus.com/alerts/codered2/010805-Analysis-CodeRedII. pdf
Hey, thanks for the reference. :) The analysis doesn't include any info about subtle biases in the PRNG, which is what I think the original poster is essentially asking. It generates addresses in the 1-254 range for each octet, and then uses some or all of them in the new IP address. Now, if the two web servers have a different first or first and second octet from each-other, that could explain it. Machines on networks with the same first or second byte as a lot of vulnerable IIS servers are going to see many more scans. Ryan _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- OT: Oddity with CRII Erek Adams (Aug 07)
- RE: OT: Oddity with CRII Mark Spieth (Aug 07)
- RE: OT: Oddity with CRII Erek Adams (Aug 07)
- RE: OT: Oddity with CRII Ryan Russell (Aug 07)
- RE: OT: Oddity with CRII Mark Spieth (Aug 07)