Subject: Re: Code Red II at the IETF meeting

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 07 Aug 2001 14:23:41 +0100

In message <[email-masked]>, Bobby Krupczak write
s:
>Hi!
>
>>Well, folks, my packet suckers have shown a Code Red II attack from a 
>>machine on the IETF meeting net.  It's 217.33.140.38 -- if you have 
>>that address, you need to disinfect and patch your machine.  For the 
>>rest of you, be careful...
>
>Do you always snoop on traffic at IETFs?
>

I'm running a monitor to detect what folks are sending to *my* 
machine:

Tue Aug  7 13:28:59 2001        tcpsuck www(80)
TCP message from host host217-33-140-38.ietf.ignite.net (217.33.140.38): port 3446

128 bytes received
    0:   47455420 2f646566 61756c74 2e696461   GET /default.ida
   16:   3f585858 58585858 58585858 58585858   ?XXXXXXXXXXXXXXX
   32:   58585858 58585858 58585858 58585858   XXXXXXXXXXXXXXXX
   48:   58585858 58585858 58585858 58585858   XXXXXXXXXXXXXXXX
   64:   58585858 58585858 58585858 58585858   XXXXXXXXXXXXXXXX
   80:   58585858 58585858 58585858 58585858   XXXXXXXXXXXXXXXX
   96:   58585858 58585858 58585858 58585858   XXXXXXXXXXXXXXXX
  112:   58585858 58585858 58585858 58585858   XXXXXXXXXXXXXXXX

(The monitor is truncating at 128 bytes, by intent.)

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: [email-masked] (Bobby Krupczak)
Date: Tue, 7 Aug 2001 11:56:35 -0400 (EDT)

Hi!

>I'm running a monitor to detect what folks are sending to *my* 

Independently, I had figured that you may be doing that.  Your email
wasnt real clear on your approach.  Again, dont read too much into my
questions.

Bobby

---

From: Gaurang Pandya <[email-masked]>
Date: Tue, 7 Aug 2001 10:33:20 -0700 (PDT)

Hi Steven,

Can you tell me what kind of monitor that is, and
where can it be obtained from. Actually I was
searching for such scanner from long.

Gaurang.
--- "Steven M. Bellovin" <[email-masked]> wrote:
> In message
> <[email-masked]>,
> Bobby Krupczak write
> s:
> >Hi!
> >
> TCP message from host
> host217-33-140-38.ietf.ignite.net (217.33.140.38):
> port 3446
> 
> 128 bytes received

__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/