Skip to Content.
Sympa Menu

wg-multicast - Re: MSDP SA explosion - sasser worm?

Subject: All things related to multicast

List archive

Re: MSDP SA explosion - sasser worm?


Chronological Thread 
  • From: Doug Pearson <>
  • To:
  • Subject: Re: MSDP SA explosion - sasser worm?
  • Date: Mon, 03 May 2004 14:57:57 -0500

Just saw word that GEANT has deactivated MSDP peering with Abilene at the
GEANT New York router due to high CPU on that router and the MSDP storm.

Doug Pearson
Indiana University


At 12:45 PM 5/3/2004 -0700, Greg Shepherd wrote:

>Yup, I see it too. Though it appears only a few AS's are suspect at
>this time:
>
>ASN: S/G
>
>6263: 9211/9206
>680: 1056/1037
>224: 955/943
>4130: 863/846
>1955: 551/551
>1741: 549/535
>137: 500/497
>2833: 292/292
>
>Greg
>
>On Mon, 3 May 2004, Bill Owens wrote:
>
>> A pointer on another list got me looking at my MSDP SA cache, with the
>> suggestion that the sasser worm might be scanning multicast space. I'm not
>> sure that's the case, since it doesn't look the same as back when ramen
>> was hitting us, but there's definitely something going on. My SA cache is
>> currently at 33k and rising.
>>
>> Bill.
>>
>>




Archive powered by MHonArc 2.6.16.

Top of Page