Re: ELF/Scalper-A Spreading?

[Drew Linsalata <drew () gothambus com>]

Doh!  That was a typo in my original message.  I meant UDP port 2001.

Drew Linsalata
The Gotham Bus Company
Internet Server and Carrier Neutral Co-Location
http://www.gothambus.com


> Most of the 'I got flodoed by apache wormed machines' floods are udp/2001
> not 2100... you sure its 2100 in your acls?

> > Our border ACLs are catching about three thousand UDP/2100 hits every minute
> > tonight.  Is anyone else seeing this?  It seems as if ELF/Scalper-A (the
> > Apache/FreeBSD worm) is spreading.