[Dshield] whisker space splice attack -
thomas.nilsen at kvernelandgroup.com
Thu Sep 19 08:27:17 GMT 2002
I assume this has to do with the OpenSSL/slapper worm, but we are seeing
something like 500 hits an hour on our Lambrea tarpit host (running against
1 IP), all with the whisker space splice attack (as detected by Snort). The
packets are only coming from a few hosts (4 new hosts in the last hour). We
do not see this signatures detected on any of our Apache/OpenSSL hosts.
Can anyone else confirm this?
Tel: +47 51429463 <> Mob: +47 991 55 001
More information about the list