Cable Modem Question

Post #3,931 by andread 8/6/01 8:30:16 AM Reply	Cable Modem Question For the last few days the RD light has been blinking constantly on the cable modem (Road Runner)whether I'm online or not At first I thought some new pain in the ass program was running in the background but not as far as I can see Have the latest AV updates on board I had to call RR on Sunday to report an outage and mentioned the blinking light but they were suddenly swamped by other callers reporting the outage What with Code Red and its clones I'm wondering what's up (I'd be more than just curious if the TD light was also blinking) This is a home machine, not a server, running Win98se A Play I Some Music w/ Papa Andy Saturday 8 PM - 11 PM ET All Night Rewind 11 PM - 5 PM Reggae, African and Caribbean Music [link\|http://wxxe.org\|http://wxxe.org]
Post #3,932 by jlalexander 8/6/01 8:35:32 AM Reply	I get almost the exact same thing. My activity light constantly blinks, and if I watch the logs on my firewall I get bombarded with "Martian packets" (what LRP calls invalid/incomplete packets where the IP may be spoofed, or some such). I can sit and watch the screen roll by with them. We brought this up in another thread, but I think the infrastructure for alot of these cable modem companies is having a hard time holding up against the sheer amount of traffic generated by this Code Red virus. -Jason ---- My pid is Inigo Montoya. You "killed -9" my parent process. Prepare to vi.
Post #3,933 by boxley 8/6/01 8:35:45 AM Reply	yer machine is phoning home run a scanner on you nic and see what kind of packets are going back and forth to make sure something nefarious isnt going on. tcpdump is a good gpl packet sniffer. thanx, bill Our bureaucracy and our laws have turned the world into a clean, safe work camp. We are raising a nation of slaves. Chuck Palahniuk
Post #3,953 by dlevitt 8/6/01 11:52:45 AM Reply	Re: Cable Modem Question Some cable providers [like Cablevision] are expreimenting with next generation set top boxes. These use some special multicast packet types [not processed by today's cable modems] but they do light some of the indicator lights.
Post #3,959 by Simon_Jester 8/6/01 12:55:55 PM Reply	nyah, I don't think that it... I've been watching the logs of my cable router - and I'm getting Port 80 hits from lots of 24.xx.xx.xx addresses. I think it's code red.
Post #4,035 by cwbrenn 8/7/01 10:52:31 AM Reply	Hmmm. The send and receive lights are always blinking on my RR box. Almost always, anyway, and always have been. I always assumed that was because of the DNS and DHCP stuff my server was doing. Mayhaps I'm assuming wrong? Hmm. "We are all born originals -- why is it so many of us die copies?" - Edward Young
Post #4,158 by deke 8/8/01 3:52:42 AM Reply	Re: Cable Modem Question It's the codered bug - here's how it works: the worm propagates by picking random IP addresses to be it's next victims. Most picks are on the local subnet, with some further away. The lights on your modem are reflecting all the ARP (addr resolution protocol) overhead associated with having lots o' traffic to random (i.e., mostly vacant) IP addresses. I'm watching the external interface on my firewall box with tcpdump right now-it looks something like this: 00:47:33.880536 arp who-has cx980340-a.dt1.sdca.home.com tell 24.13.5.1 00:47:33.914878 arp who-has cx701860-b.dt1.sdca.home.com tell 24.21.12.129 00:47:34.052775 arp who-has cx384380-a.dt1.sdca.home.com tell 24.20.246.1 00:47:34.090860 arp who-has cx943276-b.dt1.sdca.home.com tell 24.13.17.1 00:47:34.364243 arp who-has cx917811-a.dt1.sdca.home.com tell 24.20.246.1 00:47:34.392551 arp who-has cx953093-a.dt1.sdca.home.com tell 24.21.12.129 00:47:34.438820 arp who-has cx173469-a.dt1.sdca.home.com tell 24.20.246.1 00:47:34.604111 arp who-has cx248728-a.dt1.sdca.home.com tell 24.21.12.129 Cheers, -Deke

Welcome to IWETHEY!