From owner-freebsd-isp Tue Sep 18 17:34:20 2001 Delivered-To: freebsd-isp@freebsd.org Received: from buffnet4.buffnet.net (buffnet4.buffnet.net [205.246.19.13]) by hub.freebsd.org (Postfix) with ESMTP id 9985837B401 for ; Tue, 18 Sep 2001 17:34:16 -0700 (PDT) Received: from buffnet11.buffnet.net (buffnet11.buffnet.net [205.246.19.55]) by buffnet4.buffnet.net (8.9.3/8.8.7) with ESMTP id UAA26308; Tue, 18 Sep 2001 20:39:51 -0400 (EDT) (envelope-from shovey@buffnet.net) Date: Tue, 18 Sep 2001 20:34:08 -0400 (EDT) From: Stephen Hovey To: bv@wjv.com Cc: Eric_Stanfield@kenokozie.com, freebsd-isp@FreeBSD.ORG Subject: Re: Code Red?! In-Reply-To: <20010918202005.B19613@wjv.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Actually this isnt all bad - alot of my competitors folded or even promote NT..and will fold... I refuse! FreeBSD is the way man! On Tue, 18 Sep 2001, Bill Vermillion wrote: > On Tue, Sep 18, 2001 at 04:17:58PM -0500, > Eric_Stanfield@kenokozie.com thus sprach: > > > I find it interesting that everyone I've talked to today has > > logged the initial nimda attack within 30 seconds of the time you > > listed below (after adjusting for timezones). > > I've seen an accelleration of the attack this evening [EST]. > > I've had log files just exploiding in size. They are growing at > well over 500 lines per minute. We have a small company doing > specialized work and we have our own racks in a communications > facility. The servers have 100Mbit uplinks into the OC-192 > backbone so I'm not going to be limited by pipe width, which also > means that I can't get faster too. > > I've just turned off all logging for web traffic as I didn't want > to have the systems fall over for lack of drive space. > > Just a reminder here to check your log files to make sure something > like this doesn't happen to you. > > Just a file guess but here the nimda traffic is probably about 5 > times more than the highest CodeRed days. I'm sure glad I have NO > MS machines that I maintain but a client has two in our racks and I > called them about 1030 this AM. I wish them luck. > > > -- > Bill Vermillion - bv @ wjv . com > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-isp" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message