[Date Prev][Date
Next][Thread Prev][Thread Next][Date
Index][Thread Index]
Re: [OT] ARP Flooding
In article <000301c38409$6a0c50f0$1301fea9@xxxxxxx>, Julian
Stuhler wrote:
> To try and figure out what was going on, I downloaded a trial version
of
> Aligent Advisor LAN so that I could see what all the mysterious
activity
> was for. It turns out that my Win2K server is issuing thousands and
> thousands of ARP requests, starting at a value (e.g. 192.170.193.0)
and
> incrementing the target address by 1 each time. Usually, the target
> addresses are outside of my local subnet (192.168).
Sounds like the MSBlast or Welchia worm. You need to patch first and then
disinfect. You can manually disable the worm by removing the relevant
files and registry keys but you'll catch it again very quickly if you
haven't patched.
Ian Oliver
Sunny Leeds, UK
Using Java on Tini for control via Dallas 1-wire
Home |
Main Index |
Thread Index
|