> I'm getting massive packet loss to various points on the globe. > I am seeing a lot of these in my tcpdump output on each > host. > > 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376 > 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: > 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0 > > It looks like there's a worm affecting MS SQL Server which is > pingflooding addresses at some random sequence. It seems you're right. My firewall is taking alot of hits on port 1434 since about 4pm Australian Eastern Daylight Saving Time: Jan 25 16:30:31 sarkmekawk iplog[234]: UDP: dgram to port 1434 from eth870.sa.adsl.internode.on.net:1310 (376 data bytes) Jan 25 16:32:35 sarkmekawk iplog[234]: UDP: dgram to port 1434 from dev1.cinemas.ch:1683 (376 data bytes) Jan 25 16:34:21 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 216.179.192.248:4161 (376 data bytes) Jan 25 16:34:41 sarkmekawk iplog[234]: UDP: dgram to port 1434 from sql.webcoretech.com:3113 (376 data bytes) Jan 25 16:34:42 sarkmekawk iplog[234]: UDP: dgram to port 1434 from hds-connected.hds.com:3967 (376 data bytes) Jan 25 16:35:34 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 216.95.164.23:1141 (376 data bytes) Jan 25 16:35:56 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 134.210.1.226:3975 (376 data bytes) Jan 25 16:36:54 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 211.104.36.123:2550 (376 data bytes) Jan 25 16:38:30 sarkmekawk iplog[234]: UDP: dgram to port 1434 from cts21612069172.cts.com:1031 (376 data bytes) Jan 25 16:38:31 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 216.109.150.210:3462 (376 data bytes) Jan 25 16:39:02 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 207.102.74.40:4605 (376 data bytes) Jan 25 16:39:05 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 66.189.0.11:4198 (376 data bytes) Jan 25 16:39:20 sarkmekawk iplog[234]: UDP: dgram to port 1434 from dnsup1.biz.rr.com:3915 (376 data bytes) Jan 25 16:39:50 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 211.139.140.18:3623 (376 data bytes) Jan 25 16:40:24 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 210.91.85.200:1113 (376 data bytes) Jan 25 16:40:26 sarkmekawk iplog[234]: UDP: dgram to port 1434 from criminal.justice.state.mn.us:1335 (376 data bytes) Jan 25 16:40:37 sarkmekawk iplog[234]: UDP: dgram to port 1434 from server4.hostu.net:1038 (376 data bytes) Jan 25 16:40:45 sarkmekawk iplog[234]: UDP: dgram to port 1434 from 61.135.134.154:3935 (376 data bytes) That is only a very small portion of the log. There are hundreds more entries. ********************************************************* ** P&O - Celebrating 150 Years in Australia: 1852-2002 ** *********************************************************
