Printable View
....... has anyone else noticed that the level of scan events that appear disassociated with automated worms such as slammer, Code Red etc. appears to have increased quite significantly over the last few weeks.
I seem to be seeing many more scans for SMTP, FTP, NetBios (137/9/445) than in the past year or so.
Or is it just me?
If you respond to the poll I would also be interested to know the region you are working from.
Greatly increased TCP Sync requests on 445 since 1/20/03
137 at a fairly rate for the last several months
Region: Washington DC area
A lot more Code Red hits (I thought it was dead :p ) on my office systems.
Heavy netbios scan on my home systems.
And recently 'scripted' attacks coming out of east Asia.
I am located in Western Canada.
Cheers:
I don't count for the long term as I just recently learned to read my logs but heavy netbios, slammer is slacking a little, and lots of noise(disassociated) that i don't understand yet. The hits have been increasing, steadily, though.
New England
Well.... So far it doesn't seem like it is just me...... I'd have hated it if it was..... ;)
From those of you who have replied you seem to be seeing much the same as myself. I would be interested to hear from people that are outside the USA/Canada...... 'cos I can't help but think it might have a lot to do with the current political situation. In the past I have noticed spikes around significant events, (9/11 was a huge spike).
[Edit]
Oh....and yes I have to admit that Code Red does seem to be coming back to life again. Must be noobs putting utterly unpatched servers out there..... Or people redoing servers from scratch and not putting back patches that they originally had though I gotta think thats a bit far fetched.....
[/Edit]