[rescue] New worm?

[Steve Pacenka]

At Wed, 19 Sep 2001 19:28:56 -0700 David Passmore <dpassmor at sneakers.org> wrote
:

>My personal (Apache) web server has taken 12 hits from this worm. The total
>Code Red hits measured somewhere in the twenties. I'm not sure what's so
>different about my web server that it's not garnering thousands of hits,
>tho. It's a Solaris 8 box, no packet filtering or firewall rules that would
>prevent this.

Your local subnet may not have infectable servers.  90% of the worm traffic to 
my little server (about 3000 probes per day this week) is from machines in my 
132.236.*.* subnet.  A couple of dozen nearby machines are generating a lot of 
traffic.

-- SP