nanog mailing list archives
Re: New worm / port 1434?
From: Mike Leber <mleber () he net>
Date: Sat, 25 Jan 2003 00:12:37 -0800 (PST)
We are seeing this too. We are seeing the gige interfaces on multiple customer aggregation switches at multiple locations add several hundred Mbps each. All the traffic is destined for udp port 1434 with a randomized source address. We are doing "ip verify unicast source reachable-via any" which stops most of the random addresses. We've temporarily had to block udp port 1434. On Fri, 24 Jan 2003, Avleen Vig wrote:
It seems we have a new worm hitting Microsoft SQL server servers on port 1434.
+----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber () he net http://www.he.net | +-----------------------------------------------------------------------+
Current thread:
- Re: New worm / port 1434?, (continued)
- Re: New worm / port 1434? Curtis Maurand (Jan 25)
- Re: New worm / port 1434? Adam "Tauvix" Debus (Jan 25)
- Re: New worm / port 1434? Jack Bates (Jan 25)
- Re: New worm / port 1434? Mike Tancsa (Jan 25)
- Re: New worm / port 1434? Troy Rader (Jan 25)
- Re: New worm / port 1434? Mark Radabaugh (Jan 25)
- Re: New worm / port 1434? Scott Call (Jan 25)
- Re: New worm / port 1434? Adam "Tauvix" Debus (Jan 25)
- Re: New worm / port 1434? K. Scott Bethke (Jan 25)
- Re: New worm / port 1434? Neil J. McRae (Jan 25)
- Re: New worm / port 1434? Mike Leber (Jan 25)
- Re: New worm / port 1434? Avleen Vig (Jan 25)
- Re: New worm / port 1434? Stephen J. Wilcox (Jan 25)
- Re: New worm / port 1434? Len Rose (Jan 25)
- Re: New worm / port 1434? Avleen Vig (Jan 25)
- Re: New worm / port 1434? lost (Jan 25)
- Re: New worm / port 1434? Eric Gauthier (Jan 25)
- Re: New worm / port 1434? Stephen J. Wilcox (Jan 25)
- Re: New worm / port 1434? Marshall Eubanks (Jan 25)
- Re: New worm / port 1434?' David G. Andersen (Jan 25)
- Re: New worm / port 1434? Stephen J. Wilcox (Jan 25)
- Re: New worm / port 1434? Marshall Eubanks (Jan 25)
- Re: New worm / port 1434? Eric Gauthier (Jan 25)