Re: New worm / port 1434?

[Avleen Vig <lists-nanog () silverwraith com>]

On Sat, Jan 25, 2003 at 12:12:37AM -0800, Mike Leber wrote:
> We are seeing this too.
> We are seeing the gige interfaces on multiple customer aggregation
> switches at multiple locations add several hundred Mbps each.  All the
> traffic is destined for udp port 1434 with a randomized source address. We
> are doing "ip verify unicast source reachable-via any" which stops most of
> the random addresses.  We've temporarily had to block udp port 1434.

USD10 to the first person who spots a CNN reporter speculating to Saddam's
involvement.