[55090] in North American Network Operators' Group
Re: New worm / port 1434?
daemon@ATHENA.MIT.EDU (Avleen Vig)
Sat Jan 25 07:58:43 2003
Date: Sat, 25 Jan 2003 00:25:04 -0800
From: Avleen Vig <lists-nanog@silverwraith.com>
To: Mike Leber <mleber@he.net>
Cc: Avleen Vig <lists-nanog@silverwraith.com>, nanog@nanog.org
In-Reply-To: <Pine.LNX.4.21.0301250001340.31314-100000@ruby.he.net>
Errors-To: owner-nanog-outgoing@merit.edu
On Sat, Jan 25, 2003 at 12:12:37AM -0800, Mike Leber wrote:
>
> We are seeing this too.
> We are seeing the gige interfaces on multiple customer aggregation
> switches at multiple locations add several hundred Mbps each. All the
> traffic is destined for udp port 1434 with a randomized source address. We
> are doing "ip verify unicast source reachable-via any" which stops most of
> the random addresses. We've temporarily had to block udp port 1434.
USD10 to the first person who spots a CNN reporter speculating to Saddam's
involvement.
