[Dshield] Port 17300 increase

Johannes B. Ullrich jullrich at sans.org
Sat Dec 6 18:02:10 GMT 2003


> > Secondly, the dally report I receive never shows anywhere near the quantity of
> > packets that are submitted daily.  In fact usually the daily report contains
> > less than one-third of what is reported.
> 
> That would be a Johannes question. ;-)

Yes. And something I need to work on more. There are two main 
reasons why the daily reports may not match:
- we do no longer process most ICMP logs.
- your reports are not processed in time for the daily summary

However, I am working on some cases where neither one of these
reasons fully explains the problem. I am still debugging the
report to find whats exactly going on.



-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 786 1563            
  fax: (617) 786 1550                          jullrich at sans.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20031206/18d3e6b3/attachment.bin


More information about the list mailing list