Re: NIMDA Horror

[Geert Jan de Groot <GeertJan.deGroot at bsdi.com>]

>> One of the problems with the "mainstream" is the timezone difference.
> was not aware that attacks were timezone dependent.

There is actually some truth in Brian's remark. For people around 
this timezone, e.g. the IETF mailing list is quiet till ~ 15.00 local time,
at which time an avalanche of email starts that goes well into the night.
A discussion topic may be completely skinned and done with (or worse,
the focus completely changed outside of the interest of the originator),
by the time someone gets back to the office next day.

I noticed in Ghana, and someone of NCS confirmed, that traffic drops
a lot after 18.00 local time as not many people have connectivity at home.
This makes the effect a lot stronger.

Also, the effect of certain attacks is a lot different. I can see
Nimda probes cause a lot more trouble on someone's 64K sat link 
than on my 2M DSL pipe at home.

Not sure if we can wait till the next AfNOG meeting - the next attack
may be a lot worse and it's already causing serious problems.
Perhaps the AfNOG list can be used to get an initial AfCERT/AFIRST effort 
going (and then a separate list set up - hint?).
I think that liasoning with other groups is important, but just like
AfNOG != NANOG, some localized effort with good contacts with the
other groups may be a reasonable approach.

Just my 5 Euro's worth,

Geert Jan


-----
This is the afnog mailing list, managed by Majordomo 1.94.4

To send a message to this list, e-mail afnog at afnog.org
To send a request to majordomo, e-mail majordomo at afnog.org and put
your request in the body of the message (i.e use "help" for help)

This list is maintained by owner-afnog at afnog.org