North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Code Red Hammering Away
On Sat, 4 Aug 2001, Bob K wrote: > N's versus X's on a server with a block of 5 IP's as of August 1, 4AM EDT: > > 4:53:42pm|[email protected]:/home/melange> grep default.ida /var/log/httpd-access.log | grep NNNNN|wc -l > 436 > 4:53:48pm|[email protected]:/home/melange> grep default.ida /var/log/httpd-access.log | grep XXXXX | wc -l > 6 Checking back the first XXXX one I saw was about 9 hours ago, since then the number of XXXX and NNNN accesses has been about even. Actually checking other logs I would say XXX accesses are the majority (over 80%) in the last 4 or 5 hours. I would guess a better version, perhaps it deletes the old Code Red copy when it infects a machine which enables it to grow so fast. -- Simon Lyall. | Newsmaster | Work: [email protected] Senior Network/System Admin | Postmaster | Home: [email protected] ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz
|