ELF/Scalper-A Spreading?

Fri Jul 26 15:18:53 UTC 2002

Doh!  That was a typo in my original message.  I meant UDP port 2001.

Drew Linsalata
The Gotham Bus Company
Internet Server and Carrier Neutral Co-Location
http://www.gothambus.com

> Most of the 'I got flodoed by apache wormed machines' floods are udp/2001
> not 2100... you sure its 2100 in your acls?
> 

>> 
>> Our border ACLs are catching about three thousand UDP/2100 hits every minute
>> tonight.  Is anyone else seeing this?  It seems as if ELF/Scalper-A (the
>> Apache/FreeBSD worm) is spreading.
>> 