Re: SNMP worm?

From: Mark Ryan del Moral Talabis (talabis_at_gmail.com)
Date: 10/27/05

  • Next message: David Gutierrez: "RE: SNMP worm?" 
    Date: Thu, 27 Oct 2005 09:01:03 +0800
To: gillettdavid@fhda.edu

    Hi there,

    There was an instance last month that we got some suspicious SNMP
    traffic. Was the activity similar to something like this?

    http://www.philippinehoneynet.org/charts_2005-09-25/snort-pscin_signature_daily_attacks_radar_216.254.95.40_2005-09-25.gif

    http://www.philippinehoneynet.org/dataarchive.php?date=2005-09-25

    At that time I did not think it was a worm but now you've said it I
    might go back to the logs to look at it.

    Regards,
    Ryan Talabis
    Philippine Honeynet Project
    http://www.philippinehoneynet.org

    On 10/27/05, David Gillett <gillettdavid@fhda.edu> wrote:
    > We're suddenly seeing a lot of unauthorized SNMP traffic, including
    > some to broadcast destinations, from stations on our network that have
    > no business doing that. Anyone know of a new virus/worm with that
    > behaviour? (Details are still sketchy here -- I'm hoping someone else
    > has seen this and can provide clues of additional symptoms to look for.)
    >
    > David Gillett
    >
    >
    >

  • Next message: David Gutierrez: "RE: SNMP worm?"
    • Quantcast