Link Logger
Premium,MVM
join:2001-03-29
Calgary, AB
 ·Shaw
| reply to jvmorris
Re: Difference a year makes, good news, bad news
In Feb/2005 80% of all inbound 445 scans came from my local netblock x.*.*.*, drilling into this almost 98% came from x.x.*.* and at this level we see the spread of source for 445 scans. Hence you can say the most prevalent worms only vary the last two number of your IP Address when scanning. So if my local ISP wanted to drop their network bandwidth and load, they could by cleaning up locally infected systems or filtering various ports like 445.
I will add these three charts to my page which show this.
Blake
--
Vendor: Firewall Logging Software »www.SonicLogger.com - SonicWall and 3Com »www.LinkLogger.com - Linksys, Netgear and Zyxel |
|
jvmorris
I Am The Man Who Was Not There.
Premium,MVM
join:2001-04-03
Reston, VA
|  Now that is an interesting set of graphics! 
But the last one is kinda scary! (That's the various Class C subnets there, isn't it?)
--
Regards, Joseph V. Morris |
|
astirusty
Premium
join:2000-12-23
Henderson, NV
 ·AT&T Southwest
| reply to Link Logger
said by Link Logger  :drilling into this almost 98% came from x.x.*.* and at this level we see the spread of source for 445 scans. So if we want to clean up the internet of all these scans - we just need to get your entire sub-domain blocked?!?  
On a serious note, this information is very interesting. I am taking a SWAG here, but the viruses/worms are setup this way so they draw less attention? Because the hackers know (or believe) the ISPs have not in the past monitored or filtered at these levels?? |
|
