All things related to multicast

[Amel Caldwell <>]

Actually, I have been looking at the very same thing here at the University of
Washington.  I picked out six local addresses that were responsible for 800+
SA entries and they all appeared to be infected with SASSER.

Amel

On Mon, 3 May 2004, Bill Owens wrote:

>A pointer on another list got me looking at my MSDP SA cache, with the
>suggestion that the sasser worm might be scanning multicast space. I'm not
>sure that's the case, since it doesn't look the same as back when ramen was
>hitting us, but there's definitely something going on. My SA cache is
>currently at 33k and rising.
>
>Bill.
>
>