Re: worm changes port

[fingers <fingers () fingers co za>]

> > Curious to see how many saw the worm 2002 traffic change to UDP port
> > 4156 at about 5PM Sat.
>
> It hit hard here this Sunday afternoon. Found 3 servers that helped in the
> DDOS going on.. what fun.

by DDoS, are you talking about actual attack traffic, or just traffic from
other infected hosts, to your 3, on udp port 4156? I was of the
understanding that the 4156 traffic is just "bot speak" between the
infected hosts, and not actual attack traffic?

Regards

--Rob