Level3 routing issues?

Larry Rosenman ler at lerctr.org
Sat Jan 25 09:44:39 UTC 2003


MSSQL worm/DDOS/Exploit on UDP/1434

A bunch of us are blocking UDP/1434 destinations.


http://www.nextgenss.com/advisories/mssql-udp.txt

Larry Rosenman
Internet America/PDQ.NET/neosoft.com
AS4278/AS3764


--On Saturday, January 25, 2003 02:15:59 -0500 Eric Whitehill 
<eric at botbay.net> wrote:

>
> Same here...
>
> My connecion with AADS has doubled in traffic, and everything else.
>
> I've doubled my network traffic since 11:30ish PM CST...
>
> If anyone has an idea of whats going on...
>
> AS5006 is where I'm at.
>
> -Eric
>
> On Sat, 25 Jan 2003, Andy Dills wrote:
>
>> Date: Sat, 25 Jan 2003 01:37:29 -0500 (EST)
>> From: Andy Dills <andy at xecu.net>
>> To: Alex Rubenstein <alex at nac.net>
>> Cc: hc <haesu at towardex.com>, "nanog at merit.edu" <nanog at merit.edu>
>> Subject: Re: Level3 routing issues?
>>
>>
>> On Sat, 25 Jan 2003, Alex Rubenstein wrote:
>>
>> >
>> >
>> > I dunno about that. But, I am seeing, in the last couple hours, all
>> > kinds of new traffic.
>> >
>> > like, customers who never get attacked or anything, all of a sudden:
>> >
>> > 	http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865
>> > 	.html
>> >
>> >
>> > We are seeing this on ports all across out network -- nearly 1/2 our
>> > ports are in delta alarm right now.
>> >
>> > Anyone else?
>> >
>> > I will dig more to look at the traffic.
>>
>> Interesting, at almost the exact same time (call it 12:30), qwest dropped
>> all but 1000 routes through IAD...still trying to get somebody on the
>> phone at their IP noc, not having much luck. Genuity seems fine at the
>> moment...
>>
>> Any speculation yet? Kind of an odd coincidence of problems...
>>
>> Oh, just got through...fiber cut in DC?
>>
>> Andy
>>
>> xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
>> Andy Dills                              301-682-9972
>> Xecunet, LLC                            www.xecu.net
>> xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
>> Dialup * Webhosting * E-Commerce * High-Speed Access
>>
>>
>



-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 972-414-9812                 E-Mail: ler at lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749






More information about the NANOG mailing list