It's still a good thing to notify the victim. Usually they don't respond to this type of notification for some reasons. But even if they don't they usually fix their end. So, you will still benefit from this gesture since you will have one less nimda source attacking your system.
-----Original Message----- From: Walter Wart [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 09, 2002 3:44 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: Response Policy issue >What is the best thing to do when you are getting attack by Nimda or Code >Red Attack ? >- Do we notify the owner of the IP address ? >We have a defense against this attacks, but they keep on coming from many >places. I used to notify the owners of attacking IP addresses. Out of several hundred responses sent I got three our for thank yous, a lot of non responses, a few who were angry, and several automated requests from ISPs asking for all the relevant log entries and nothing after that. It would probably be the neighborly thing to do, but it will be mostly unappreciated and will not noticeably increase your systems' own reliability.
