RE: Full analysis of the .ida "Code Red" worm.

19 Jul 2001

      I'm seeing it as 2 attacks.

Initial packet is a fragmented GET:

length = 4

000 : 47 45 54 20                                       GET 

Next packet is the worm payload.
---------
To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz
where the body of your message reads:
unsubscribe nznog

RE: Full analysis of the .ida "Code Red" worm.

Gordon Smith