Worm probes
Joseph McDonald
joe at vpop.net
Tue Sep 18 16:51:43 UTC 2001
spc> Has anyone else been seeing a dramatic increase in /scripts/.. NT worm
spc> probes this morning? We're seeing about 8000/second, starting around 9:15
Yes. We are seeing it here bigtime. Does anyone have any apache hacks
to lessen the impact? One idea: Once a probe is sent, the prober's
IP# is stored in a hash (perhaps in shared memory or a mmap'd file
that all children can share) and new connections from that IP are no
longer accepted.
thanks,
-joe
More information about the NANOG
mailing list