[Dshield] whisker space splice attack -

Thomas Nilsen thomas.nilsen at kvernelandgroup.com
Thu Sep 19 08:27:17 GMT 2002


I assume this has to do with the OpenSSL/slapper worm, but we are seeing
something like 500 hits an hour on our Lambrea tarpit host (running against
1 IP), all with the whisker space splice attack (as detected by Snort). The
packets are only coming from a few hosts (4 new hosts in the last hour).  We
do not see this signatures detected on any of our Apache/OpenSSL hosts.

Can anyone else confirm this?

Best Regards,
Thomas Nilsen
Kverneland IT
Tel: +47 51429463 <> Mob: +47 991 55 001




More information about the list mailing list