North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Worm probes

  • From: Joe Abley
  • Date: Tue Sep 18 11:59:57 2001 
On Tue, Sep 18, 2001 at 11:05:35AM -0400, [email protected] wrote:
> ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k
> box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this
> time of day, although still well short of capacity...apache server
> processor load is WAY up just from the requests, and the logs are growing
> like mad.

I'm sitting behind a dialup box right now, and I just added a log
clause to an ipf rule matching connection attempts to port 80.

I'm averaging 35 probes per minute. Blocking them is quite beneficial
to performance on a v.34 connection :)


Joe