nanog mailing list archives
Re: New worm / port 1434?
From: Scott Call <scall () devolution com>
Date: Sat, 25 Jan 2003 02:11:24 -0800 (PST)
I'm seeing obscene amounts of 1434/udp traffic at my transit and peering points. I've filtered it out in both directions everywhere my network touches the outside world. It's almost 20% of my traffic at this point. I think I've calmed the internal storm so far, but we'll see. I saw refence to an ICMP "trigger" packet. Is there any info on this and is it possible to filter for it w/o killing all ICMP traffic? It'd be nice to know I won't have any more routers or switches fall over tonight. Colo customers seem to be the worst off, the rate limiting kills the router or the traffic kills the backbone. decisions, decisions... -S -- Scott Call Router Geek, ATGi, home of $6.95 Prime Rib "Nothing is less productive than to make more efficient what should not be done at all." -Peter Drucker
Current thread:
- Re: New worm / port 1434?, (continued)
- Re: New worm / port 1434? Jake Khuon (Jan 25)
- Re: New worm / port 1434? Josh Richards (Jan 25)
- Re: New worm / port 1434? Mike Tancsa (Jan 25)
- Re: New worm / port 1434? Simon Lockhart (Jan 25)
- Re: New worm / port 1434? Curtis Maurand (Jan 25)
- Re: New worm / port 1434? Adam "Tauvix" Debus (Jan 25)
- Re: New worm / port 1434? Jack Bates (Jan 25)
- Re: New worm / port 1434? Mike Tancsa (Jan 25)
- Re: New worm / port 1434? Simon Lockhart (Jan 25)
- Re: New worm / port 1434? Troy Rader (Jan 25)
- Re: New worm / port 1434? Mark Radabaugh (Jan 25)
- Re: New worm / port 1434? Scott Call (Jan 25)
- Re: New worm / port 1434? Adam "Tauvix" Debus (Jan 25)
- Re: New worm / port 1434? K. Scott Bethke (Jan 25)
- Re: New worm / port 1434? Neil J. McRae (Jan 25)
- Re: New worm / port 1434? Mike Leber (Jan 25)
- Re: New worm / port 1434? Avleen Vig (Jan 25)
- Re: New worm / port 1434? Stephen J. Wilcox (Jan 25)
- Re: New worm / port 1434? Len Rose (Jan 25)
- Re: New worm / port 1434? Avleen Vig (Jan 25)
- Re: New worm / port 1434? lost (Jan 25)
- Re: New worm / port 1434? Eric Gauthier (Jan 25)
- Re: New worm / port 1434? Stephen J. Wilcox (Jan 25)
- Re: New worm / port 1434? Eric Gauthier (Jan 25)