Looks like there may be a worm going around hitting systems that run BlackIce. Common characteristics of the packets: Source port 4000 (but random target port) and the string "insert witty message here".
details will be posted here: http://isc.sans.org/diary.html as I get them together. -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 837 2807 [EMAIL PROTECTED] contact details: http://johannes.homepc.org/contact.htm
signature.asc
Description: This is a digitally signed message part
