Good day! I would appreciate some information about the Slapper_Worm signature. Literally 'all of a sudden' we are getting hits on that signature. They appear to be inbound from many IP addresses to only two IP addresses within our network umbrella. Funny thing is one IP belongs to a hosted web site (hosted on Win2K Server) and the other one belongs to an ISDN IP pool and is rarely in use. Actually, I've never noticed the IP having been allocated when the hits on it come in! But the hits keep coming in(?).
My question: Why would an increasingly large number of IP addresses try to attach via Slapper_Worm to one IP that is absolutely not Unix and one IP that is rarely used by anyone? The hits are the port 4156 to port 4156 type. Thank you in advance for any assistance you can offer! Verne Baxter Sierra Tel Internet (STI) [EMAIL PROTECTED] _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
