[Techtalk] Weird http leeches

[John Elliott]

On May 13, 2002 02:44 am, Dave North wrote:
[snip]

> At this point, I'm assuming this traffic is fairly widespread (running
> into John -- in Canada I think -- with this small population, and having
> two of four servers I can access affected -- both in California.) I have
> not been able to find any references to it on the internet in general via
> google, or at any security sites I fished around.
>
> I have lots of questions. For example, what the heck is going on? Could
> all our acks "flood" the poor spoofed IPs (making them the targe?) Anybody
> else hear anything about this? If you check any servers you can access, do
> you see similar traffic?
> 	Etcetera. I'm fascinated by this puzzle, and I have some strange
> urge to get to the bottom of it. I also wouldn't mind contributing to some
> effort to nail the perp, if I could.
>
> Help!

I think this is a discussion of the same problem:

http://online.securityfocus.com/archive/75/256047/2002-02-10/2002-02-16/0



John