logo       

Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...

Re: Warning -- floods of Allaple worm alerts.... sid:200329(2-5): msg#00122

security.ids.snort.bleedingsnort

Subject: Re: Warning -- floods of Allaple worm alerts.... sid:200329(2-5)

I monitor about 35 networks. Two of them are getting lots of hits, the rest are not. I see 197 unique hosts sending out the traffic.

It's gotta be 'bot traffic. So our choices are send a letter to the owning ISP or shun them. or do nothing.

for me the only relevant question is, "bot or not?"

If it really becomes overwhelming I might turn off the inbound probes and the outbound replies.

Is there any chance this is not bot traffic?

jp


Quoting Matt Jonkman
<jonkman-WwB1pFISwSkm7effSn6vN9HuzzzSOjJt@xxxxxxxxxxxxxxxx>:

I've seen an increase, but not near that scale. It would seem to be an
intentional thing.

Perhaps we need to threshold those sigs, maybe once every 5 minutes by
source. I'll do so.




Over the last 24 hours we have had about 50 sources fire 20 million ping
packets containing the string that triggers the Allaple signature. The
only affect it has has is to gum up my snort database. I don't believe
this is worm traffic and if is a ddos it is pretty feeble. It was
however a fairly effective dos against my snort system -- two sensors
saw this traffic so that's a total of over 40 million events in the
database. :(

I have now disabled all those rules and am (slowly) deleting all the
records from the data base. Can I suggest that these rules be disabled
by default with a comment saying why.

Anyone got any idea why this traffic was sent (I doubt if they were
really trying to attack my snort system). They have sent enough
traffic to random addresses to map our network 200 times over.





-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact: services-MMNQ1ylbVXZN8Ch2cx6nig@xxxxxxxxxxxxxxxx


<Prev in Thread] Current Thread [Next in Thread>
Google Custom Search

Recently Viewed:
qnx.openqnx.dev...    gcc.libstdc++.c...    solaris.opensol...    information-ret...    misc.misterhous...    web.catalyst.ge...    apache.webservi...    redhat.release....    hardware.lirc/2...    kernel.autofs/2...    technology.sust...    linux.vdr/2003-...    editors.lyx.gen...    org.user-groups...    netbsd.devel.pk...    xdg.devel/2004-...    version-control...    jakarta.slide.d...    debian.packages...    creativecommons...    ports.ppc.embed...    bug-tracking.bu...   
Home | blog view | USPTO Patent Archive | advertise | OSDir is an inevitable website. super tiny logo

Free Magazines

Cisco News
Receive a free quarterly e-newsletter with exclusive articles on how Cisco IT uses its own products and solutions to enable the business.
subscribe

Systems Management News, the newspaper for IT systems administration and data center managers! Each issue of Systems Management News is chock-full of news and analysis to help you understand what's happening in your field.
subscribe

The Enterprise Newsweekly eWeek is the essential technology information source for builders of e-business.
subscribe

Oracle Magazine Oracle Magazine contains technology strategy articles, sample code, tips, Oracle and partner news, how to articles for developers and DBAs, and more. Oracle (NASDAQ: ORCL) is the world's largest enterprise software company.
subscribe

Total Telecom Total Telecom is "The Economist of the communications industry".
subscribe

Navigation