MAJOR INTERNET ATTACK CURRENTLY UNDERWAY

Outspot | 9/2/2003 | Outspot

[rwfromkansas]

The dorm internet was down here at my college (likely started by the Blaster worm, which cripples networks when it gets in). It also was very slow. It still is slow, but improving, so I am hoping things get back online.

Hallelujah....I can get on FR again! I have only been able to get on it in the student govt. office for short periods of time until now.

[mhking]

BellSouth was fine this morning.

[BlessedBeGod]

Can anyone explain this to me? I've never seen this before.

In Zone Alarm, it's showing medium alerts, the program being either Internet Explorer or Opera, the source IP is one I've never heard of before, the destination IP me, the direction "routed" instead of incoming or outgoing, and the action taken was blocked.

I've never seen the program as my browser before (only Real Player or Windows Media Player, etc.), and I've never seen the direction as "routed." Since I've been having problems the last hour, is there something going on here? I finally had to unplug my cable modem to reconnect to the internet.

Thanks ahead of time.

[MarkL]

We're not having any problems, and we really don't care if this high speed links go down, since we've got a backup plan... We've implemented a backup solution using RFC 1149. This ensures that we've always got a way to communicate over the Internet, no matter how many routers are crashed... Of course, there are some disadvanteges to this method, and it isn't really very good for "real time" applications or graphics...

Mark

[Ouachita]

According to my firewall log, the major Internet problem right now is still the Sobig.F ICMP packet storm

I use the free version of Zone Alarm with my cable connection. It's logged almost 20,000 ICMP hits since 8-19-03. They're mostly from an ISP in Canada.

[SGCOS]

The Internet gets cleaned and purged on a quarterly basis, and for anybody to blame a virus is a simple case of ignorance.

[Marie Antoinette]

I *did* have 6 (yes, SIX) old sent items that I dumped. They've been there a while, weird that I got the message today. I was nowhere near the storage limit!

Thanks, hopefully that will take care of it.

[thoughtomator]

It only takes one sent item with a large attachment to pack a mailbox. Hopefully that was the problem. Keep me posted.

[snopercod]

I've been noticing that FR pages seem slow to load for over a week now. I thought it was just my brain...

[WVNan]

Same here cod. My puter is extremely sloooowww, and I'm on cable.

[First_Salute]

RAM

And then set the "virtual page" or "swap file" to allow the System to vary it automatically.

[TechJunkYard]

A partial listing of my firewall summary log from yesterday:

                I/P:Sock             Origin I/P:Sock
16:53:08  2 Sep .50:53     PROTO=17  202.160.241.130:47567
16:53:09  2 Sep .50:53     PROTO=17  211.13.227.66:25411
16:53:18  2 Sep .50:53     PROTO=17  202.160.241.130:47567
16:53:19  2 Sep .50:53     PROTO=17  211.13.227.66:25411
16:55:03  2 Sep .50:53     PROTO=17  203.197.173.129:41769
16:55:03  2 Sep .50:53     PROTO=17  203.199.107.187:33868
16:55:03  2 Sep .50:53     PROTO=17  211.13.227.66:25411
16:55:03  2 Sep .50:53     PROTO=17  202.54.111.72:21096
16:55:03  2 Sep .50:53     PROTO=17  202.160.241.130:47567
16:55:13  2 Sep .50:53     PROTO=17  203.197.173.129:41769
16:55:13  2 Sep .50:53     PROTO=17  203.199.107.187:33868
16:55:13  2 Sep .50:53     PROTO=17  211.13.227.66:25411
16:55:13  2 Sep .50:53     PROTO=17  202.54.111.72:21096
16:55:13  2 Sep .50:53     PROTO=17  202.160.241.130:47567

What I see is a couple of coordinated attacks on my DNS. The addresses are in China, Japan and India. Last Friday there were some addresses in Guam jumping all over my web server.

This could be someone probing weaknesses, a prelude to a zombie attack. I don't see any of these IPs on NetWatchman so perhaps they're just picking on me. But if they're not, enough of these probes can slow down parts of the net.

[Marie Antoinette]

Are you on a home network? I got this "routed" message today, and clicked the "more info" button, and it said this could be caused by our network configuration. Makes perfect sense. Next time the 2nd computer is booted up, I'll check to see if that does it. It's either that or the proxy program for us!

If that's not it, then I have no clue!