Not sure. I do know that I have been informing the EDUs that seem to have multiple nodes infected and actually am getting a response from them that they are being fixed. Don't know. -Joe

---------- From: Stephen J. Wilcox[SMTP:steve@opaltelecom.co.uk] Sent: Wednesday, August 01, 2001 1:28 PM To: Steven M. Bellovin Cc: k claffy; nanog@nanog.org Subject: Re: Code Red growth stats

On Wed, 1 Aug 2001, Steven M. Bellovin wrote:

...

I ran a little script on the totals reported by www.incidents.org, calculating the ratio between successive samples. (The latest graph I could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of steady exponential growth in there, but it seems to be tailing off. That's consistent with another report posted here.

Does anyone have any theories as to why its tailing, are the thousands of vulnerable machines being patched all of a sudden? If not then why is traffic decreasing so fast when the worm just keeps searching?

Steve