Gary, The 1434/udp is most likely the SQL Slammer Worm that's still very active.
George > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Gary.Ferguson > Sent: Friday, August 01, 2003 10:36 AM > To: [EMAIL PROTECTED] > Subject: [IMail Forum] OT Service sweeps > > > Do any of you see alot of service sweeps on your network? I > get hundreds of > these a day. Usually ports 137 and 1434. > I would think our ISP would block this but then again it's > probably better > that they don't filter. > > UDP_Service_Sweep 2003-08-01 13:51:57 > Source IP 148.221.102.24 Port N/A > Destination IP 206.69.0.0 Port 137 > > DISPLAY=Default:0,EMAIL=Default:0,LOGDB=LogWithoutRaw:0,OPSEC= > LockSrcAddr:0 > Priority low > Alert Type SuspiciousUDP > > Gary > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%> 40list.ipswitch.com/ > > Knowledge Base/FAQ: > http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
