This was how I tackled it: 1) Create an access-list that blocks traffic from coming into tcp port 80 ip access-list extended deny-port-80 deny tcp any any eq 80 permit ip any any 2) Apply the access-list onto all your router's interfaces for incoming traffic ip access-group deny-port-80 in 3) After you've done all that and looking forward to finding out the infected host, on each interfaces, disable the above access-list and enable "ip route-cache flow" and then get out of config mode and perform a "show ip cache flow" you will be able to see certain traffic that are from a single source to multiple different destination on port 80 (reflected as 0050 under destination port). 4) Get out there and patch the infected host !!!!! Good luck. ----- Original Message ----- From: "Erick B." To: "Ron Tan" ; Sent: Saturday, August 18, 2001 11:32 PM Subject: Re: please tell me what is "ip input" process?it cost me more [7:16457] > Can you post your config (clean up IP info)? > > --- Ron Tan wrote: > > looks like you've got the code red worm running wild > > on your network. > > > > Refer to: > > > > > http://www.cisco.com/warp/customer/63/ts_codred_worm.shtml > > > > ----- Original Message ----- > > From: "cslx" > > To: > > Sent: Saturday, August 18, 2001 9:56 PM > > Subject: please tell me what is "ip input" > > process?it cost me more than > > [7:16455] > > > > > > > CPU utilization for five seconds: 99%/3%; one > > minute: 99%; five minutes: > > 99% > > > PID Runtime(ms) Invoked uSecs 5Sec 1Min > > 5Min TTY Process > > > 23 18762964 280084 66991 81.81% 92.45% > > 92.58% 0 IP Input > > > it makes my network so slow,how can I resolve the > > problem? > > > thanks > > > > __________________________________________________ > Do You Yahoo!? > Make international calls for as low as $.04/minute with Yahoo! Messenger > http://phonecard.yahoo.com/ Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=16482&t=16482 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]