[50346] in North American Network Operators' Group
Re: ELF/Scalper-A Spreading?
daemon@ATHENA.MIT.EDU (Drew Linsalata)
Fri Jul 26 11:19:34 2002
Date: Fri, 26 Jul 2002 11:18:53 -0400
From: Drew Linsalata <drew@gothambus.com>
To: "Christopher L. Morrow" <chris@UU.NET>, <nanog@nanog.org>
In-Reply-To: <Pine.GSO.4.33.0207260334080.11730-100000@rampart.argfrp.us.uu.net>
Errors-To: owner-nanog-outgoing@merit.edu
Doh! That was a typo in my original message. I meant UDP port 2001.
Drew Linsalata
The Gotham Bus Company
Internet Server and Carrier Neutral Co-Location
http://www.gothambus.com
> Most of the 'I got flodoed by apache wormed machines' floods are udp/2001
> not 2100... you sure its 2100 in your acls?
>
>>
>> Our border ACLs are catching about three thousand UDP/2100 hits every minute
>> tonight. Is anyone else seeing this? It seems as if ELF/Scalper-A (the
>> Apache/FreeBSD worm) is spreading.
>>
