[Gllug] Analysing worm traffic

[Simon Wilcox]

I've been tracking the snort logs on my firewall for the last month or so
and have seen the number of welchia/blaster attack attempts rise from
660/day to 9,125 during Saturday. Nearly all these are coming from within 
Telewest's own network.

I don't expect that complaining to their helldesk is likely to do anything
other than raise my blood pressure as they must already know how
widespread this infection is yet they seem to be doing nothing about it.

So my question is - does anyone know how much traffic is generated by each
attempt ? I'm guessing that it's not much but since the activity light on
my cable modem is pretty much permanently on these days, it would be nice
to know at what point I could claim a denial of service and start talking 
about compensation !

Simon.


-- 
Gllug mailing list  -  Gllug at linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug