Worm probes
Joe Abley
jabley at automagic.org
Tue Sep 18 15:49:03 UTC 2001
On Tue, Sep 18, 2001 at 11:05:35AM -0400, up at 3.am wrote:
> ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k
> box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this
> time of day, although still well short of capacity...apache server
> processor load is WAY up just from the requests, and the logs are growing
> like mad.
I'm sitting behind a dialup box right now, and I just added a log
clause to an ipf rule matching connection attempts to port 80.
I'm averaging 35 probes per minute. Blocking them is quite beneficial
to performance on a v.34 connection :)
Joe
More information about the NANOG
mailing list