 |
 |
> > I suspect that one of the reasons the ACD DSL service is better is > > because there are more customers on the MSU IP's than the ACD IP's. > > Or perhaps ACD has an easier time contacting their customers which are > > infected (MUCH smaller user base). For the record, yesterday evening, > > my monitor picked up 4 infected computers in ACD's East Lansing > > territory. That's apparently more than enough to swamp the network. > > For what it's worth, on Tuesday evening I examined the blaster/welchia > like worm traffic I could see from my MSU/ACD DSL connection. There > were two machines exhibiting symptoms. They were generating on the > order of 7000 ARP packets per minute. For comparison, the ACD router > was generating something on the order of 270 ARPs per minute for > presumably legitimate business. > > Over the weekend, I was seeing four infected machines. > > Right now, things seem pretty good: no worm-like behavior, and pretty > good performance. We're renewing our efforts to notify users with computers still exhibiting Welchia symptoms. It appears that we still have several hundred infected computers on campus, and more on the dial-up network. I see one infected computer right now on the East Lansing portion of the MSU ACD DSL network. Doug Doug Nelson [log in to unmask] Network Manager Ph: (517) 353-2980 Computer Laboratory http://www.msu.edu/~nelson/ Michigan State University