RE: [cobalt-users] NIMDA

["Vachon, Scott" <Scott.Vachon@xxxxxxxxxxxxxx>]

> on 30/9/2001 10:39 AM, Carrie Bartkowiak at 
> ravencarrie@xxxxxxxx wrote:
> 
> > On Sun, 30 Sep 2001 10:09:13 +0300, Mustafa Cavcar mumbled 
> something like:
> >>> How are we going to stop these NIMDA attacks filling logs?
> > 
> > Quite honestly, the only thing I can think of is to unplug 
> the server. Maybe
> > contacting your upstream provider might help, if they can 
> block the traffic at
> > the router, but since they're normal web requests (from 
> what I gather; I
> > wasn't getting mail for the big Nimda discussion) you can't 
> block them and
> > can't stop them from getting recorded in your logs.
> 
> Well, in my opinion, this is not absolutely correct. What you 
> can do is (as
> example) this:
> 

The .dll, or .ida files can be dropped at an edge router as well if you use
a Cisco router. You will need to use : 2600 3640 7200 IOS 12.1(5)T and the
7500 IOS 12.1(6)E. Check www.cisco.com for more info or here:
http://iponeverything.net/CodeRed.html . The beauty of this solution is that
it can be used to block Code Red infections today and can be easily modified
with new signatures in the future using the HTTP sub-port classification
mechanism in IOS.

~S~

Disclaimer: My own two cents.