[Date Prev][Date
Next][Thread Prev][Thread Next][Date
Index][Thread Index]
RE: [OT] ARP Flooding
Oh nuts.
Thanks for the pointer - I'll check this out tonight....
Julian
______________________
Julian Stuhler
DB2 Specialist, IBM Gold Consultant
Triton Consulting - The Database Experts
E-mail: julian.stuhler@xxxxxxx
Web: <http://www.triton.co.uk/> http://www.triton.co.uk
Mobile: +44 (0)7768 446927
Personal Fax: +44 (0)870 1243510
Office Tel: +44 (0)870 2411550
Office Fax: +44 (0)870 2411549
-----Original Message-----
From: Ian Oliver [mailto:ioliver.lists@xxxxxxx]
Sent: 26 September 2003 09:51
To: ukha_d@xxxxxxx
Subject: Re: [ukha_d] [OT] ARP Flooding
In article <000301c38409$6a0c50f0$1301fea9@xxxxxxx>, Julian
Stuhler wrote:
> To try and figure out what was going on, I downloaded a trial version
of
> Aligent Advisor LAN so that I could see what all the mysterious
activity
> was for. It turns out that my Win2K server is issuing thousands and
> thousands of ARP requests, starting at a value (e.g. 192.170.193.0)
and
> incrementing the target address by 1 each time. Usually, the target
> addresses are outside of my local subnet (192.168).
Sounds like the MSBlast or Welchia worm. You need to patch first and
then
disinfect. You can manually disable the worm by removing the relevant
files and registry keys but you'll catch it again very quickly if you
haven't patched.
Ian Oliver
Sunny Leeds, UK
Using Java on Tini for control via Dallas 1-wire
[Non-text portions of this message have been removed]
Home |
Main Index |
Thread Index
|