|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: 1434 traffic
> What I'm seeing from on my personal network connections is a lot of > traffic to udp port 1434 start at 05:30:08 UTC. I did some graphing of reports we got to DShield/ISC up to 9am EST. http://isc.sans.org/port1434start.gif The part that amazes me is the speed. It saturated within 1 minute! Does anybody else see the oscillations in traffic? I remember seeing something similar in netflow data for slapper (2002 udp). Or is this just an artifact of our particular dataset? So far, we got about 80,000 sources (distinct IPs sending port 1434 packets) -- -------------------------------------------------------------------- [email protected] Collaborative Intrusion Detection join http://www.dshield.org
|
