Re: [Full-Disclosure] New variant of Nachi ?

[Florian Weimer <fw@deneb.enyo.de>]

Helmut Springer wrote:

> Has anyone seen any evidence besides this and the two postings on
> public lists?  No real trace after more than 24h it seems...

We see increased scanning activity, but it doesn't look like a
widespread worm:

    date    | sources | targets | flows
------------+---------+---------+-------
 2003-10-20 |    8058 |   10796 | 27206
 2003-10-21 |    3331 |    5908 | 11425
 2003-10-22 |    3660 |    7324 | 13989
 2003-10-23 |    2137 |    3853 |  6885
 2003-10-24 |    1459 |    3603 |  5505
 2003-10-25 |    1743 |    5717 |  9193
 2003-10-26 |    4248 |    5487 | 10954
 2003-10-27 |    8117 |   10073 | 23920
 2003-10-28 |    8463 |   10658 | 27231
 2003-10-29 |    3651 |    5171 | 10898

(Date, number of distinct source addresses, number of distinct target
addresses, flows AKA connection attempts -- incoming packets only, and
and the 2003-10-29 row is still increasing, of course.)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html