[80752] in North American Network Operators' Group
Re: Blocking port udp/tcp 1433/1434
daemon@ATHENA.MIT.EDU (Gadi Evron)
Wed May 11 15:29:26 2005
Date: Wed, 11 May 2005 22:30:25 +0400
From: Gadi Evron <ge@linuxbox.org>
To: Joe Maimon <jmaimon@ttec.com>
Cc: nanog@nanog.org
In-Reply-To: <42825A1D.3000408@ttec.com>
Errors-To: owner-nanog@merit.edu
> f) slammers half life is incredibly long
Worms have a very long life on the Internet, we still see swen.. and we
still see (although interesting) niche worms that attacked just one
specific personal firewall. :/
> Does anybody have any idea of the rate of NEW slammer infections?
The net is an incredible maze, it still happens (or more to the point
RE-happens). But I believe that if you will look at the IP's (or at
least DHCP ranges) sending the packets, you will find some similarities.
Gadi.