- NZNOG - lists.nznog.org

Code Red Stats
by Craig Whitmore 07 Aug '01

07 Aug '01

I've been running a running couter of hits on 1 machine take logs from 500 IP addresses's (2 C Classes). Its Hits/sec has gone up from yesterday from about 3.4->6.9 and growing fast :-( Total Seconds = 8878 Total Unique Machines Infected = 6380 Total Hits = 51169 Total Hits/Sec = 6.89 Also I have it emailing the owners of the Unique IP addresses (automaticlly) (with an ugly script) and telling that their machines are infected and so far have had many happy people repling thanking me. (But the Number of infected machines still increases :-( ) This is only from 2 C Class Addresses.. I can't imagine how many hits/sec NZ is getting in Total from Overseas.. There have only been a few infected machines from inside NZ (mostly from Xtra and WorldNet Dialups) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

TCP Header Definition help request "Window"
by Mike Sutton [ awacs ] 07 Aug '01

07 Aug '01

TCP Header Could an expert tell me "how" the "window" value is generated and "what" explicitly it means... Appreciate your help as my reference books don't help and I have not been able to locate a precise definition on the Net. Michael Sutton --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 7

root.exe
by Dylan Reeve 07 Aug '01

07 Aug '01

Any ISPs had a look through their proxy logs for "root.exe" or "cmd.exe" so far? I bet there will be a few... Going to go after people for 'hacking'? -- Dylan Reeve - dylan(a)wibble.net "Um, yeah." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red: NZ vs Canada
by Dan Langille 07 Aug '01

07 Aug '01

I can give you two lots of stats, one from a NZ server, the other from a Canada server: http://www.langille.org/stats-red-worm/ - in Wellington http://www.freebsddiary.org/stats-red-worm/ - in Ottawa Both are updated every 30 minutes, 15 minutes after and after the hour. -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Whazzup w/ Ihug?
by Juha Saarinen 06 Aug '01

06 Aug '01

http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?203.98.56.1 70 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red Weirdness
by Mark Foster 06 Aug '01

06 Aug '01

[Tue Aug 7 13:56:39 2001] [error] [client 203.199.60.10] Invalid URI in request XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u 8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Ive had just one today, in the last half hour. None prior to that Did someone try to write a variant and screw up or maybe one of the infectees got weird? At 13:58 7/08/2001 +1200, you wrote: >[Tue Aug 7 13:57:14 2001] [error] [client 203.228.144.15] Invalid URI in >request >XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a >HTTP/1.0 > >Just started getting these. no default.ida?. > >Has the worm turned, again? > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >---- "Cold silence has a tendency to atrophy any sense of compassion" ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Code Red Stats
by Neil 06 Aug '01

06 Aug '01

Hi All, After about 30 second's of thinking about how to get rrdtool or mrgt to display what Code Red is up to on my server I decided to use webalizer instead. It defiantly gives you a better view on what is going on, have a look at http://203.97.86.130/codered/usage_200108.html . I have put the script in the cron.hourly directory so check back as often as you like. Neil Fincham Integral LTD.

6 8

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: "Barry Raveendran Greene" <bgreene(a)cisco.com> Date: Mon, 6 Aug 2001 05:18:53 -0700 > Is anyone seeing router impact caused by all the bogus queries sent out by > Code Red? Just wondering if there could be some side effects. We had the cpu running at 100% on our border router till we tuned the access-lists to deal with traffic to port 80 early. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Internet issues for discussion at APEC TEL24
by Frank March 06 Aug '01

06 Aug '01

I have previously posted information about APEC TEL24 to this list inviting people to join the NZ delegation. As a reminder: the meeting will take place 19-21 September in Jeju, Korea. It will be preceeded by two days (17,18 September) of workshops on various areas. I will be there for all five days. Details at http://www.apectel24.org/. Please feel free to pass the contents of this email on to anyone you think may be interested. One workshop area is 'Internet issues'. The first draft of the programme is as follows. I invite anyone to send to me **(off-line)** comments about any of the matters mentioned. Note that this was the first forum to raise the issue of international Internet charging (and that matter is still hanging around). There is an invitation to comment on agenda matters and I will probably take that up in 10 days or so. >From the organisers..... "The Workshop will consist of two parts. The FIRST part will consist of three presentations (20 minutes each) about the following topics: 1.- Presentation about the Current State of the Debate on Internet Issues. 2.- Presentation about the development of traffic flows within and between Latin American countries and other regions. 3.- Presentation about the situation of small ISP's in the Asia-Pacific region. The SECOND part will consist of an open-floor moderated discussion between the delegates. We suggest the following topics. Please we will appreciate if you could indicate your first three issues of more interest: 1.- APEC Contribution to promoting Internet access in the Asia-Pacific Region 2.- Traffic Exchange Models (Current and Next Generation) How is Internet traffic exchanged? What financial mechanisms are in place for the exchange of Internet traffic and how are they encouraging Internet development? What are the trends in content location and how do these factors influence Internet traffic patterns and financial arrangements? 3.- Global Capacity Availability and Trading What are the recent developments in large-scale bandwidth provision? What are the recent developments in retail internet service provision? How do global capacity relate to Internet traffic exchange? 4.- Local Internet Interconnection What are the main principles of the new interconnection frameworks? How much progress has been made in developing interconnection frameworks appropriate to the exchange of Internet traffic? 5.- Role for Regulators Is there a role for regulators? What are the policy implications for some of the directions Internet traffic exchange will take with next generation Internet architecture? 6.- Users Needs How do users view current developments in Internet traffic exchange? How does the financial community view the current state of play? User Needs - IP-based services and content providers. 7.- WTO What is the current state of the debate? How negotiating frameworks from different countries compare? What is the treatment of Internet services in the negotiating frameworks? 8.- Internet Connectivity What policy and regulatory reforms are required to stimulate Internet development and address the international digital divide? What regulatory barriers exist to the development of the Internet including infrastructures such as international connectivity, domestic teledensity and Internet exchange points? How can economies maximise the benefits of their Internet development including lower costs for infrastructure service? (development funds) 9.- Costs and Prices What is going to replace the international settlements system in the new environment? How are countries adapting to the changes in settlement rates? 10.- Quality Voice over IP " Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 11:15:46 +1200 > What IOS version? Are you running compiled ACLs? Don't know, no. Its not actually my box I just get to look at it occasionally when they have issues. > That seems to help a > fair bit if your CPU bound due to access-list activity. I just looked up the docs on compiled access-lists and the reference I found implied that they were only available on 7200's and bigger boxes. > Also, you can > try "show access-list blah" and reorder the most frequent terms to > nearer the top. I've cleaned the lists up several times in the past (as well as they could be) but they keep adding more ugliness to them. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0