slapper changed to udp 1812?

Tue Oct 1 17:01:53 UTC 2002

On Tue, 1 Oct 2002, fingers wrote:

>
> hi
>
> I might be totally off the mark here, but has slapper now changed to port
> 1812? This'll make it really difficult to filter, if you're using this
> port for RADIUS.
>

We saw this yesterday, directed at a previously infected slapper.a
(2002/udp backchannel) host on a a customer's network, and I sent the
captured info to CERT to see what they made of it.

I didn't know if it was the slapper communications channel, or one of the
triggered DDOSs from slapper.

-S