RE: Code Red on 98, 95 computers

[Ciaron Gogarty <cgogarty () lancomms ie>]

Use CAR with cisco, or some other QOS with other vendors to reduce the
amount of bandwidth your TARPit will eat up!!

-----Original Message-----
From: John Sage [mailto:jsage () finchhaven com]
Sent: 27 August 2001 16:56
To: Snort-users (E-mail)
Subject: Re: [Snort-users] Code Red on 98, 95 computers


To whom it may concern:

Be aware that LaBrea requires unused IP addresses within a block over 
which you have administrative control.

If you don't have access to unused IP addresses, LaBrea will do nothing 
for you.

And LaBrea has *nothing* whatsoever to do with Code Red and Win 95 98 
boxes..

- John

-- 
John Sage
FinchHaven, Vashon Island, WA, USA
http://www.finchhaven.com/
mailto:jsage () finchhaven com
"The web is so, like, five minutes ago..."


Frontgate Lab wrote:

> Hi,
>
>  Ive noticed a lot of email recently in various lists concerning Code
> Red and its variants . Basically people talk about it but no solutions
> are ever voiced.
> Well here is a Sort of solution:
>
> Go to www.trinux.org
>
> Go to where it says "fight code red!"
>
> Get the Labrea Disk Image and do what it says.
>
> This little honey-pot has saved me and my servers a lot of headache . I
> would not be surprised if you saw a significant increase in your
> bandwidth while useing Labrea.
>
> If your like most sysadmins  you will find an old pentium lying around
> doing nothing  hopefully you have a nic card as well . stick in the
> labrea floppy and GO!
>
> Enjoy , and make sure you thank the author.
>
> Sincerely.
>  
>
>   Madhav Diwan
>  
>  Senior Developer
>
>  Frontgate Systems
>
> JP wrote:
>
> > Win 9x are not affected since they do not have the indexing service.
> > JP
> >
> > ----- Original Message -----
> > From: "Missaghi, Shawn" <Shawn.Missaghi () jacobs com>
> >
> > > Hey all,
> > > Want Code red supposed to attack NT servers with IIS or 98, 95 with
> > Personal
> >
> > > web server?
> > > We have few 98, 95 systems in our network with Code Red signature.
> > > Any idea?




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users