unforum

[aqualung1105]

BTW - The spike mentioned by Beth in her mail to Phil was, as I said, at least one week earlier, so we have at least two...

[Marl64]

[aqualung1105]

Marl -

You mention in the ID-thread the childish method of coding info in gibberish -
Have you looked at this:

We sadly build the sad fool
Because the beasts come behind the bottom balls.
Who do the cows come so sadly and cleverly?
What are the balls?
A table drags secretly above the high flowers.
The table writes.

- from the unjust files, obviously...
I´m going out IRL now, been here a long time.
I´ll be back! - said the governator - sorry, Terminator...

[AnthraX101]

One thing I noticed was that they couldn't even get onto the boxes while they were getting hit by this. If their processor is only at 10% though, it must be some form of connection saturation to cause connectivity problems (assuming processor use isn't throttled). This looks more like a DoS then a security scan. I am still thinking that Laberinth is some sort of counter-attack system.

AnthraX101

[Marl64]

[Marl64]

[AnthraX101]

Well, strictly speaking CPU usage is another angle of DoS. Along with memory usage, and network resources, you can create a DoS without actualy filling up the network pipe, simply make more connections then the server can handle.

However, once they see that their CPUs are spiking at 10%, one would think they would look at whatever the bottle neck is.

AnthraX101

[xnbomb]

Logger numbers

[yeahyeah]

load average isnt percent..

[xnbomb]

A little on load average

[Marl64]

[Scorpio]

Re: A little on load average

[Marl64]

Re: A little on load average

[Marl64]

Forgetting about what's in the logs now, but looking more at what the logs say, I see two possibilities.

1) The spike occurred at roughly the same time on each system and the times are there to indicate the location of the system (based on timezones).

2) The Spike is moving from system to system, in which case we need to know the location of the systems to corrolate a pattern.

Sadly you can't combine the two.

I would like to include in the first, that this would lead to the location of the hackers, but given the nature of hackers, I couldn't possibly justify it.

[yeahyeah]

yes, there data almost certainly in that format (I've never seen a tool that logs the load average via syslog before though ;)), but remember, the last two columns are averages over a longer duration, so they'll 'spike' at the same time, but decay differently (depending on if it was 'one burst' or more..)

Those loads really arent that crazy though, I've seen isps that run at load averages of 20 or 25, but thats with a lot of shell users, etc.

And if you don't have your web server configured properly and it gets /.'d then you can see your averages go through the roof. Systems I use typically have averages of 0.00 - 0.02, but they do jump when heavy database stuff is going on.. =)

To me, the hackers talking about the averages was more of an attempt to show the gravity of the situation, and to possibly point out the epicenter of the disturbance (or the fact that it wasn't isolated to one region), I don't think any analysis of the 'exact' load values will be very useful, but could help show where it was most concentrated sorta.
But since different machines may have different amounts of memory, processor(s), and not to mention number of running processes, its not going to be exact..