All things related to multicast

[Bill Owens <>]

One of the participants in the INCIDENTS list discussion suggested to 
me that scanning one's network for TCP port 27374 would detect 
machines infected with the ramen worm, perhaps before they began 
scanning the multicast space. That would also find Windows Sub-7 
trojans, and although those aren't dangerous to multicast networks 
they are still a bad thing. . .

If your security policy permits it, you might want to consider such a 
scan to try to find the hosts before they cause damage. Of course, 
you could also use the actual scanner from ramen to look for 
exploitable Linux machines and secure them before they are broken 
into, if you're feeling particularly adventurous ;)

Bill.