We think now that we were/are seeing nimda infected systems searching for
other systems listening on port 80.  Internally, we thought we were seeing
spoofed MAC addresses, starting with 00-00-5e, but that turned out to be
"normal" behaviour of our routers.

Bruce.
----------------------------------------------------------------------
  Bruce J. Senn                               Phone:  (518) 388-6664
  Senior System Manager                       FAX:    (518) 388-6458
  Union College                             E-mail:  [log in to unmask]
  Schenectady, NY 12308           WWW:  http://www1.union.edu/~sennb
----------------------------------------------------------------------
> -----Original Message-----
> From: Senn, Bruce
> Sent: Friday, September 21, 2001 11:02 AM
> To: 'Peter Osborne'; [log in to unmask]
> Subject: RE: Jazz Down?
>
>
> FWIW, we believe that "something" is going on with the wider
> internet.  A "disruption" of some sort since late yesterday
> afternoon (EDT).  All I have are sketchy reports that it is
> difficult to reach many sites.
>
> I may know more after an "emergency" meeting at 1:30 this afternoon.
>
> HTH.
>
> Bruce.

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *