<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: Code Red growth stats </TITLE>
</HEAD>
<BODY>
<P><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">Not sure. I do know that I have been informing the EDUs that seem to have multiple nodes infected and actually am getting a response from them that they are being fixed.</FONT></P>
<P><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">Don't know. </FONT>
</P>
<P><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">-Joe</FONT>
</P>
<UL>
<P><FONT SIZE=2 FACE="MS Sans Serif">----------</FONT>
<BR><B><FONT SIZE=2 FACE="MS Sans Serif">From:</FONT></B> <FONT SIZE=2 FACE="MS Sans Serif">Stephen J. Wilcox[SMTP:steve@opaltelecom.co.uk]</FONT>
<BR><B><FONT SIZE=2 FACE="MS Sans Serif">Sent:</FONT></B> <FONT SIZE=2 FACE="MS Sans Serif">Wednesday, August 01, 2001 1:28 PM</FONT>
<BR><B><FONT SIZE=2 FACE="MS Sans Serif">To:</FONT></B> <FONT SIZE=2 FACE="MS Sans Serif">Steven M. Bellovin</FONT>
<BR><B><FONT SIZE=2 FACE="MS Sans Serif">Cc:</FONT></B> <FONT SIZE=2 FACE="MS Sans Serif">k claffy; nanog@nanog.org</FONT>
<BR><B><FONT SIZE=2 FACE="MS Sans Serif">Subject:</FONT></B> <FONT SIZE=2 FACE="MS Sans Serif">Re: Code Red growth stats </FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">On Wed, 1 Aug 2001, Steven M. Bellovin wrote:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">> I ran a little script on the totals reported by www.incidents.org, </FONT>
<BR><FONT SIZE=2 FACE="Arial">> calculating the ratio between successive samples. (The latest graph I </FONT>
<BR><FONT SIZE=2 FACE="Arial">> could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of </FONT>
<BR><FONT SIZE=2 FACE="Arial">> steady exponential growth in there, but it seems to be tailing off. </FONT>
<BR><FONT SIZE=2 FACE="Arial">> That's consistent with another report posted here.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Does anyone have any theories as to why its tailing, are the thousands of</FONT>
<BR><FONT SIZE=2 FACE="Arial">vulnerable machines being patched all of a sudden? If not then why is</FONT>
<BR><FONT SIZE=2 FACE="Arial">traffic decreasing so fast when the worm just keeps searching?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Steve</FONT>
</P>
<BR>
<BR>
</UL>
</BODY>
</HTML>