[Dshield] Some sort of statistics...

Shawn Cox shawn.cox at pcca.com
Sun Aug 17 19:03:28 GMT 2003


I was thinking this very thing this morning, instead of taking it on the
chin they decided to just let the worm beat everyone else up.

My 2 class C's are still seeing a great deal of port 135 attempts:

c:\diag>grep -c "/135 " pixfirewall08*.txt
pixfirewall080903.txt:2030
pixfirewall081003.txt:2323
pixfirewall081103.txt:78650
pixfirewall081203.txt:169711
pixfirewall081303.txt:157264
pixfirewall081403.txt:132272
pixfirewall081503.txt:120407
pixfirewall081603.txt:113341
pixfirewall081703.txt:55481

--Shawn



----- Original Message ----- 
From: "John Sage" <jsage at finchhaven.com>
To: "General DShield Discussion List" <list at dshield.org>
Sent: Sunday, August 17, 2003 1:31 PM
Subject: Re: [Dshield] Some sort of statistics...


> Continuing...
>
> Context: dialup into AT&T's Seattle WA POP, 12.82.x.x class A
>
> On Sat, Aug 16, 2003 at 03:51:07PM -0700, John Sage wrote:
> > For the 25 hours from 08/15/03 08:55am PDT to 08/16/03 09:54am PDT:
> >
> > Total packets to port 135 in alert.full-Aug.16.09:54: 3075
> > Total packets to port 137 in alert.full-Aug.16.09:54: 345
> > Total packets to port 4444 in alert.full-Aug.16.09:54: 1662
>
> For the 25 hours from 08/16/03 09:54am PDT to 08/17/03 11:12am PDT:
>
> Total packets to port 135 in alert.full-Aug.17.11:12: 2415
>
> Total packets to port 137 in alert.full-Aug.17.11:12: 208
>
> Total packets to port 4444 in alert.full-Aug.17.11:12: 1074
>
>
> I certainly am comforted to know that Micro$oft took care of it's
> little problem (windowsupdate.com); meanwhile the rest of the universe
> continues to go to hell, thanks to Micro$oft...
>
>
> - John
> -- 
> "Warning: time of day goes back, taking countermeasures."
>
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
>




More information about the list mailing list