Port 500 scans

[klaus.dombrofsky () degussa com]

Hi,

On my IDS i detected massive scans from single ip-addresses to different 
ip-addresses with source  AND targetport 500.
This scan uses alsmost the whole bandwith of our internet-access.

Question:
Does someone know any existing worm using a VPN-vulnerability ?
 
best regards 
Klaus-Peter Dombrofsky
its.on 
Global Network Services
Security Management
T +49.(0)8621 86 3057
M +49.(0)175 2617851
E-Mail: Klaus.Dombrofsky () degussa com 
GPG-Key available