Re: [nznog] ICMP and port 80 traffic

On 10 Oct 2003 08:57:01 +1300 Donovan Jones wrote:

...

We are seeing the same thing here its currently hitting some of our unused address space.

Yay, not just me!

Seeing the same thing here, a lot of traffic hitting our unused ip addresses. Started on Thursday last week...

...

Have you found out anything more about it?

Heard a rumour of a variant of Welchia/Nachi.a but nothing more... Still seeing it streaming in... :(

Could be Welchia, although the varients of that I've seen scan sequentially within each /24, and the incomming traffic I see doesn't follow a pattern like thats... (it's more or less random source and destination) Hopefully it is the Welchia worm and not something more destructive, as Welchia is programmed to self destruct in 2004 :) Regards, Simon