Home page logo

nanog logo nanog mailing list archives

Re: Sobig.f surprise attack today
From: Mike Tancsa <mike () sentex net>
Date: Thu, 28 Aug 2003 16:24:48 -0400

At 11:14 PM 28/08/2003 +0300, Petri Helenius wrote:
Mike Tancsa wrote:

I dont think this would work too well. The users who are infected often think something is wrong because their connection and computer are not working quite right. So they disconnect / reconnect / reboot so they burn through quite a few dynamic IP addresses along the way.
This is an artifact of ISP´s wanting to have static IP´s as an add-on premium service so they provide short lease times and change IP as often as it´s feasible without
interrupting service unneccessarily.

Huh ? This is an artifact of the way PM3s and MAX 6096s work with respect to how IP addresses are assigned out of pools.... i.e. this is the default behaviour. The same goes for our DSL pool.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]