North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: slapper changed to udp 1812?

  • From: Scott Call
  • Date: Tue Oct 01 13:05:04 2002 
On Tue, 1 Oct 2002, fingers wrote:

>
> hi
>
> I might be totally off the mark here, but has slapper now changed to port
> 1812? This'll make it really difficult to filter, if you're using this
> port for RADIUS.
>

We saw this yesterday, directed at a previously infected slapper.a
(2002/udp backchannel) host on a a customer's network, and I sent the
captured info to CERT to see what they made of it.

I didn't know if it was the slapper communications channel, or one of the
triggered DDOSs from slapper.

-S