1434 traffic

Sun Jan 26 00:27:04 UTC 2003

On Sat, 25 Jan 2003, Johannes Ullrich wrote:

:
:
: > What I'm seeing from on my personal network connections is a lot of
: > traffic to udp port 1434 start at 05:30:08 UTC.
:
: I did some graphing of reports we got to DShield/ISC up to 9am EST.
: http://isc.sans.org/port1434start.gif
:
: The part that amazes me is the speed. It saturated within 1 minute!

Maybe they read "How to Own the Internet in Your Spare Time?"  :-)

scott

: Does anybody else see the oscillations in traffic? I remember seeing
: something similar in netflow data for slapper (2002 udp). Or is this
: just an artifact of our particular dataset?
:
: So far, we got about 80,000 sources (distinct IPs sending port 1434
: packets)
:
:
:
: --
: --------------------------------------------------------------------
: jullrich at euclidian.com             Collaborative Intrusion Detection
:                                          join http://www.dshield.org
: