Re: 1434 traffic

["Johannes Ullrich" <jullrich () euclidian com>]

> What I'm seeing from on my personal network connections is a lot of
> traffic to udp port 1434 start at 05:30:08 UTC. 

I did some graphing of reports we got to DShield/ISC up to 9am EST.
http://isc.sans.org/port1434start.gif

The part that amazes me is the speed. It saturated within 1 minute!

Does anybody else see the oscillations in traffic? I remember seeing
something similar in netflow data for slapper (2002 udp). Or is this
just an artifact of our particular dataset?

So far, we got about 80,000 sources (distinct IPs sending port 1434
packets)



-- 
--------------------------------------------------------------------
jullrich () euclidian com             Collaborative Intrusion Detection
                                         join http://www.dshield.org