CNS has taken steps to mitigate the impact of the DOS attack
mentioned below.

Given the information currently available it appears that this
attack is being caused by computers infected with the W32.Welchia
worm.  A significant portion of the attack is coming from machines
at York that still have not been cleaned and/or patched properly.

In order to block the attack, we are now blocking ICMP packets that
are 92 bytes long at the router interfaces. Unfortunately, the
amount of traffic generated on-campus by infected machines is so
significant that simply blocking it is placing a large load on the
campus routers.  CNS will continue to monitor the situation.

Questions or concerns about this note, should be directed to
the CNS Helpdesk in the Computing Commons, William Small Centre,
(voice: 416-736-5800, email: [log in to unmask]).

---------- Forwarded message ----------
Date: Thu, 28 Aug 2003 12:06:19 -0400
From: Donal Lynch <[log in to unmask]>
Reply-To: [log in to unmask]
To: [log in to unmask]
Subject: Network Service Interruptions - August 28
Resent-Subject: Network Service Interruptions - August 28

York's Network is currently suffering from a significant Denial of
Service (DOS) Attack.  At this point, the attacks appear to be
coming from a large number of computers at York and from the
Internet. This attack is negatively impacting network performance
and blocking access to network resources.  CNS is working to address
the problem, but it may take several hours before service returns to
normal.

Questions or concerns about this note, should be directed to
the CNS Helpdesk in the Computing Commons, William Small Centre,
(voice: 416-736-5800, email: [log in to unmask]).