- NZNOG - lists.nznog.org

Code Red: NZ vs Canada
by Dan Langille 06 Aug '01

06 Aug '01

I can give you two lots of stats, one from a NZ server, the other from a Canada server: http://www.langille.org/stats-red-worm/ - in Wellington http://www.freebsddiary.org/stats-red-worm/ - in Ottawa Both are updated every 30 minutes, 15 minutes after and after the hour. -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Whazzup w/ Ihug?
by Juha Saarinen 06 Aug '01

06 Aug '01

http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?203.98.56.1 70 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red Weirdness
by Mark Foster 06 Aug '01

06 Aug '01

[Tue Aug 7 13:56:39 2001] [error] [client 203.199.60.10] Invalid URI in request XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u 8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Ive had just one today, in the last half hour. None prior to that Did someone try to write a variant and screw up or maybe one of the infectees got weird? At 13:58 7/08/2001 +1200, you wrote: >[Tue Aug 7 13:57:14 2001] [error] [client 203.228.144.15] Invalid URI in >request >XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a >HTTP/1.0 > >Just started getting these. no default.ida?. > >Has the worm turned, again? > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >---- "Cold silence has a tendency to atrophy any sense of compassion" ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Code Red Stats
by Neil 06 Aug '01

06 Aug '01

Hi All, After about 30 second's of thinking about how to get rrdtool or mrgt to display what Code Red is up to on my server I decided to use webalizer instead. It defiantly gives you a better view on what is going on, have a look at http://203.97.86.130/codered/usage_200108.html . I have put the script in the cron.hourly directory so check back as often as you like. Neil Fincham Integral LTD.

6 8

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: "Barry Raveendran Greene" <bgreene(a)cisco.com> Date: Mon, 6 Aug 2001 05:18:53 -0700 > Is anyone seeing router impact caused by all the bogus queries sent out by > Code Red? Just wondering if there could be some side effects. We had the cpu running at 100% on our border router till we tuned the access-lists to deal with traffic to port 80 early. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Internet issues for discussion at APEC TEL24
by Frank March 06 Aug '01

06 Aug '01

I have previously posted information about APEC TEL24 to this list inviting people to join the NZ delegation. As a reminder: the meeting will take place 19-21 September in Jeju, Korea. It will be preceeded by two days (17,18 September) of workshops on various areas. I will be there for all five days. Details at http://www.apectel24.org/. Please feel free to pass the contents of this email on to anyone you think may be interested. One workshop area is 'Internet issues'. The first draft of the programme is as follows. I invite anyone to send to me **(off-line)** comments about any of the matters mentioned. Note that this was the first forum to raise the issue of international Internet charging (and that matter is still hanging around). There is an invitation to comment on agenda matters and I will probably take that up in 10 days or so. >From the organisers..... "The Workshop will consist of two parts. The FIRST part will consist of three presentations (20 minutes each) about the following topics: 1.- Presentation about the Current State of the Debate on Internet Issues. 2.- Presentation about the development of traffic flows within and between Latin American countries and other regions. 3.- Presentation about the situation of small ISP's in the Asia-Pacific region. The SECOND part will consist of an open-floor moderated discussion between the delegates. We suggest the following topics. Please we will appreciate if you could indicate your first three issues of more interest: 1.- APEC Contribution to promoting Internet access in the Asia-Pacific Region 2.- Traffic Exchange Models (Current and Next Generation) How is Internet traffic exchanged? What financial mechanisms are in place for the exchange of Internet traffic and how are they encouraging Internet development? What are the trends in content location and how do these factors influence Internet traffic patterns and financial arrangements? 3.- Global Capacity Availability and Trading What are the recent developments in large-scale bandwidth provision? What are the recent developments in retail internet service provision? How do global capacity relate to Internet traffic exchange? 4.- Local Internet Interconnection What are the main principles of the new interconnection frameworks? How much progress has been made in developing interconnection frameworks appropriate to the exchange of Internet traffic? 5.- Role for Regulators Is there a role for regulators? What are the policy implications for some of the directions Internet traffic exchange will take with next generation Internet architecture? 6.- Users Needs How do users view current developments in Internet traffic exchange? How does the financial community view the current state of play? User Needs - IP-based services and content providers. 7.- WTO What is the current state of the debate? How negotiating frameworks from different countries compare? What is the treatment of Internet services in the negotiating frameworks? 8.- Internet Connectivity What policy and regulatory reforms are required to stimulate Internet development and address the international digital divide? What regulatory barriers exist to the development of the Internet including infrastructures such as international connectivity, domestic teledensity and Internet exchange points? How can economies maximise the benefits of their Internet development including lower costs for infrastructure service? (development funds) 9.- Costs and Prices What is going to replace the international settlements system in the new environment? How are countries adapting to the changes in settlement rates? 10.- Quality Voice over IP " Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 11:15:46 +1200 > What IOS version? Are you running compiled ACLs? Don't know, no. Its not actually my box I just get to look at it occasionally when they have issues. > That seems to help a > fair bit if your CPU bound due to access-list activity. I just looked up the docs on compiled access-lists and the reference I found implied that they were only available on 7200's and bigger boxes. > Also, you can > try "show access-list blah" and reorder the most frequent terms to > nearer the top. I've cleaned the lists up several times in the past (as well as they could be) but they keep adding more ugliness to them. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red - Network Impact?
by Barry Raveendran Greene 06 Aug '01

06 Aug '01

Hi Folks, Is anyone seeing router impact caused by all the bogus queries sent out by Code Red? Just wondering if there could be some side effects. Barry --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 10:46:27 +1200 > On Tue, Aug 07, 2001 at 10:36:51AM +1200, Mark Davies wrote: > We had the cpu running at 100% on our border router till we tuned > the access-lists to deal with traffic to port 80 early. > Ouch... what kind of router? Where was all the CPU being spent? A cisco 2600 with a rather ugly set of access-lists having to deal with the probes for an entire Class B net. I was somewhat surprised that it couldn't deal with it as it was only about 100 probes a second (this was last Friday). Tweaking the access-lists got the load down to about 40-50%. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Code Red V3!?
by Lindsay Druett 06 Aug '01

06 Aug '01

You must be a Bob Jones Fan.... "Location, location, location...." Those poor souls that are topologically near NT servers that have been infected are getting hammered :/ If you're getting hammered, you live in a bad neighbourhood, time to cleanup or move :) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1