[Dshield] Putting the last 2 weeks into perspective

Jon R. Kibler Jon.Kibler at aset.com
Sun Aug 24 15:11:44 GMT 2003


Friday, we shut off logging of incoming ICMP echo requests. They were simply overwhelming our router log. We had been logging dropped ICMP traffic ever since the router was installed (just before the first of May). When (if?) things calm back down, we will again turn on ICMP logging.

Just to put things into perspective, our router packet reject logs for the last two weeks are about 3 times larger than all the router logs combined from about the first of May through August 9th. In other words, it appears that our intrusion attempt traffic is running about 25 times its normal weekly average.

Is this about what other are seeing? Just curious.

Jon R. Kibler
A.S.E.T., Inc.
Charleston, SC  USA




More information about the list mailing list