Blocking port udp/tcp 1433/1434

Wed May 11 19:16:45 UTC 2005

Joe Maimon wrote:
> 
> Is there still justification for denying transit for ms-sql slammer ports?
> 
> 
> Thanks,
> 
> Joe
> 
> 

Thanks all for your responses. To me it appears that

a) If you block 135/445 you should block slammer as well
b) If the number of potential infected hosts connected to your network 
can threaten your service, you should block.
c) If you are more concerned about eliminating crap on the net than in 
accomodating every whim of your users and are not doing pure transit, 
block it.
d) Microsoft should consider migrating to a new port for sql server.
e) if you are doing pure transit and not blocking anything, nobody will 
expect you to block slammer either.
f) slammers half life is incredibly long

Does anybody have any idea of the rate of NEW slammer infections?

Thanks,
Joe