and three... it's better that you put in a web page :-D By the way, it's a good way to flood a server, but i'm not sure about the accuracy Chubasco ----- Original Message ----- From: "Peter Romianowski" Date: Monday, September 24, 2001 8:32 pm Subject: RE: [suse-security] Is it possible to return something, so Nimda would crash?

now we are two :-)

...

-----Original Message----- From: Alexey N. Solofnenko [mailto:alexeys@citechlabs.com] Sent: Tuesday, September 25, 2001 12:26 AM To: Subject: RE: [suse-security] Is it possible to return something, so Nimda would crash?

Maybe you can publish the script here?

_____

< http://members.home.co > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually)

-----Original Message----- From: Thomas Lamy [mailto:Thomas.Lamy@netwake.de] Sent: Monday, September 24, 2001 1:38 PM To: 'Alexey N. Solofnenko'; suse-security@suse.com Subject: AW: [suse-security] Is it possible to return something, so Nimda would crash?

Hi, you can always ask ARIN (whois whois.arin.net <ip>) or (in Europe) RIPE (whois.ripe.net), it will give you the administrative contact(s) for the netblock the questioned ip is in.

I hacked a small shell script which takes an access_log file from my servers, extracts the nimda-type requests, does a lookup of the admin's> email and sends him _one_ mail (with URLs pointing to NIMDA informations and how to remove it).

Can't tell how successful I was with this attempt, but sent out 350 mails and received no "shut up"...

Thomas

..............