Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: New worm / port 1434?

  • From: Josh Richards
  • Date: Sat Jan 25 09:25:50 2003

Note, further analysis makes me believe that the ICMP we saw immediately
beforehand was a coincidence and unrelated.  The origin of the ICMP has
been traced to a customer application.

-jr

* Josh Richards <jrichard@cubicle.net> [20030125 00:21]:
> 
> A preliminary look at some of our NetFlow data shows a suspect ICMP payload
> delivered to one of our downstream colo customer boxes followed by a
> 70 Mbit/s burst from them.  The burst consisted of traffic to seemingly random
> destinations on 1434/udp.  This customer typically does about 0.250 Mbit/s
> so this was a bit out of their profile. :-)  Needless to say, we shut them
> down per a suspected security incident.  The ICMP came from 66.214.194.31 
> though that could quite easily be forged or just another compromised box.  
> We're seeing red to many networks all over the world though our network seems 
> to have quieted down a bit.  Sounds like a DDoS in the works.  
> 
> Anyone else able to corroborate/compare notes? 

----
Josh Richards <jrichard@{ geekresearch.com, cubicle.net, digitalwest.net }>
Geek Research, LLC - Digital West Networks, Inc - San Luis Obispo, CA 
KG6CYK - IP/Unix/telecom/knowledge/coffee/security/crypto/business/geek





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.