[52430] in North American Network Operators' Group
Re: slapper changed to udp 1812?
daemon@ATHENA.MIT.EDU (Scott Call)
Tue Oct 1 13:03:23 2002
Date: Tue, 1 Oct 2002 10:01:53 -0700 (PDT)
From: Scott Call <scall@devolution.com>
To: <nanog@merit.edu>
In-Reply-To: <20021001184840.P32062-100000@snow.fingers.co.za>
Errors-To: owner-nanog-outgoing@merit.edu
On Tue, 1 Oct 2002, fingers wrote:
>
> hi
>
> I might be totally off the mark here, but has slapper now changed to port
> 1812? This'll make it really difficult to filter, if you're using this
> port for RADIUS.
>
We saw this yesterday, directed at a previously infected slapper.a
(2002/udp backchannel) host on a a customer's network, and I sent the
captured info to CERT to see what they made of it.
I didn't know if it was the slapper communications channel, or one of the
triggered DDOSs from slapper.
-S
