Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: 1434 traffic

  • From: Scott Weeks
  • Date: Sat Jan 25 20:40:25 2003



On Sat, 25 Jan 2003, Johannes Ullrich wrote:

:
:
: > What I'm seeing from on my personal network connections is a lot of
: > traffic to udp port 1434 start at 05:30:08 UTC.
:
: I did some graphing of reports we got to DShield/ISC up to 9am EST.
: http://isc.sans.org/port1434start.gif
:
: The part that amazes me is the speed. It saturated within 1 minute!


Maybe they read "How to Own the Internet in Your Spare Time?"  :-)

scott




: Does anybody else see the oscillations in traffic? I remember seeing
: something similar in netflow data for slapper (2002 udp). Or is this
: just an artifact of our particular dataset?
:
: So far, we got about 80,000 sources (distinct IPs sending port 1434
: packets)
:
:
:
: --
: --------------------------------------------------------------------
: jullrich@euclidian.com             Collaborative Intrusion Detection
:                                          join http://www.dshield.org
:





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.