North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: 1434 traffic

  • From: Johannes Ullrich
  • Date: Sat Jan 25 17:20:02 2003


> What I'm seeing from on my personal network connections is a lot of
> traffic to udp port 1434 start at 05:30:08 UTC. 

I did some graphing of reports we got to DShield/ISC up to 9am EST.
http://isc.sans.org/port1434start.gif

The part that amazes me is the speed. It saturated within 1 minute!

Does anybody else see the oscillations in traffic? I remember seeing
something similar in netflow data for slapper (2002 udp). Or is this
just an artifact of our particular dataset?

So far, we got about 80,000 sources (distinct IPs sending port 1434
packets)



-- 
--------------------------------------------------------------------
jullrich@euclidian.com             Collaborative Intrusion Detection
                                         join http://www.dshield.org