Sobig.f surprise attack today

Thu Aug 28 20:24:48 UTC 2003

At 11:14 PM 28/08/2003 +0300, Petri Helenius wrote:
>Mike Tancsa wrote:
>
>>
>>I dont think this would work too well.  The users who are infected often 
>>think something is wrong because their connection and computer are not 
>>working quite right. So they disconnect / reconnect / reboot so they burn 
>>through quite a few dynamic IP addresses along the way.
>This is an artifact of ISP´s wanting to have static IP´s as an add-on 
>premium service
>so they provide short lease times and change IP as often as it´s feasible 
>without
>interrupting service unneccessarily.

Huh ?  This is an artifact of the way PM3s and MAX 6096s work with respect 
to how IP addresses are assigned out of pools.... i.e. this is the default 
behaviour.  The same goes for our DSL pool.

         ---Mike 