[Dshield] How Do You Detect Code Red Host Scans

Tim Dwayne Southard tim.southard at starband.net
Thu Aug 2 22:41:27 GMT 2001


My IDS (Cisco Secure) is not detecting the host scans from infected machines.  I can see the default.ida?NNN stuff but I think that is the second stage (infection).  I need to see the port 80 scans regardless of whether they are scanning MS boxes.  Any assistance will be repaid with good Karma.

Tim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.dshield.org/pipermail/list/attachments/20010802/18ba6b79/attachment.htm


More information about the list mailing list