Not sure. I do know that I have been informing the EDUs that seem to have multiple nodes infected and actually am getting a response from them that they are being fixed.

Don't know.

-Joe

----------
From:   Stephen J. Wilcox[SMTP:steve@opaltelecom.co.uk]
Sent:   Wednesday, August 01, 2001 1:28 PM
To:     Steven M. Bellovin
Cc:     k claffy; nanog@nanog.org
Subject:        Re: Code Red growth stats




On Wed, 1 Aug 2001, Steven M. Bellovin wrote:

> I ran a little script on the totals reported by www.incidents.org,
> calculating the ratio between successive samples.  (The latest graph I
> could find, as of 1615 EDT, ended at 1400 EDT.)  There was a period of
> steady exponential growth in there, but it seems to be tailing off. 
> That's consistent with another report posted here.

Does anyone have any theories as to why its tailing, are the thousands of
vulnerable machines being patched all of a sudden? If not then why is
traffic decreasing so fast when the worm just keeps searching?

Steve