[55125] in North American Network Operators' Group
Re: New worm / port 1434?
daemon@ATHENA.MIT.EDU (Stephen J. Wilcox)
Sat Jan 25 11:43:21 2003
Date: Sat, 25 Jan 2003 13:35:21 +0000 (GMT)
From: "Stephen J. Wilcox" <steve@telecomplete.co.uk>
To: Avleen Vig <lists-nanog@silverwraith.com>
Cc: Mike Leber <mleber@he.net>, nanog@nanog.org
In-Reply-To: <20030125082504.GM58624@silverwraith.com>
Errors-To: owner-nanog-outgoing@merit.edu
On Sat, 25 Jan 2003, Avleen Vig wrote:
>
> On Sat, Jan 25, 2003 at 12:12:37AM -0800, Mike Leber wrote:
> >
> > We are seeing this too.
> > We are seeing the gige interfaces on multiple customer aggregation
> > switches at multiple locations add several hundred Mbps each. All the
> > traffic is destined for udp port 1434 with a randomized source address. We
> > are doing "ip verify unicast source reachable-via any" which stops most of
> > the random addresses. We've temporarily had to block udp port 1434.
>
> USD10 to the first person who spots a CNN reporter speculating to Saddam's
> involvement.
I didnt realise he was such a computer expert!
