Subject: big DDoS worm

From: "James P. Salsman" <[email-masked]>
Date: Thu, 19 Jul 2001 21:30:30 -0700 (PDT)

Those of you with IIS servers might want to keep a close eye on 
them and their traffic to 198.137.240.92:

  http://slashdot.org/article.pl?sid=01/07/19/2230246

Also, if you have a Cisco 67x or a 3Com LanModem, um, well, it 
might not be working.

Cheers,
James

---

From: "James P. Salsman" <[email-masked]>
Date: Fri, 20 Jul 2001 00:40:43 -0700 (PDT)

> them and their traffic to 198.137.240.92...

Sorry, the worm is attacking port 80 of 198.137.240.91, not .92 -- 
the target address apparently had a short enough time-to-live in 
its DNS cache settings, and they swaped the address over.

  http://www.eeye.com/html/Research/Advisories/AL20010717.html

Apparently this is not causing too much of a dent:

  http://average.miq.net/

Cheers,
James

---

From: "James P. Salsman" <[email-masked]>
Date: Fri, 20 Jul 2001 11:53:43 -0700 (PDT)

> Why did you send this to the IETF mailing list? This has nothing to 
> do with IETF engineering work, nor with other IETF-wide topics.

Watching the Internet absorb ten terabytes per hour as no more than a 
50% latency spike is interesting and relevant to congestion engineering.

  http://average.miq.net/Weekly/markMM.html

  http://slashdot.org/comments.pl?sid=01/07/19/2230246&cid=5

Cheers,
James