North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: New worm / port 1434?

  • From: Avleen Vig
  • Date: Sat Jan 25 08:00:20 2003 
On Sat, Jan 25, 2003 at 12:12:37AM -0800, Mike Leber wrote:
> 
> We are seeing this too.
> We are seeing the gige interfaces on multiple customer aggregation
> switches at multiple locations add several hundred Mbps each.  All the
> traffic is destined for udp port 1434 with a randomized source address. We
> are doing "ip verify unicast source reachable-via any" which stops most of
> the random addresses.  We've temporarily had to block udp port 1434.

USD10 to the first person who spots a CNN reporter speculating to Saddam's
involvement.