wg-multicast - Re: MSDP SA explosion - sasser worm?
Subject: All things related to multicast
List archive
- From: Doug Pearson <>
- To:
- Subject: Re: MSDP SA explosion - sasser worm?
- Date: Mon, 03 May 2004 14:57:57 -0500
Just saw word that GEANT has deactivated MSDP peering with Abilene at the
GEANT New York router due to high CPU on that router and the MSDP storm.
Doug Pearson
Indiana University
At 12:45 PM 5/3/2004 -0700, Greg Shepherd wrote:
>Yup, I see it too. Though it appears only a few AS's are suspect at
>this time:
>
>ASN: S/G
>
>6263: 9211/9206
>680: 1056/1037
>224: 955/943
>4130: 863/846
>1955: 551/551
>1741: 549/535
>137: 500/497
>2833: 292/292
>
>Greg
>
>On Mon, 3 May 2004, Bill Owens wrote:
>
>> A pointer on another list got me looking at my MSDP SA cache, with the
>> suggestion that the sasser worm might be scanning multicast space. I'm not
>> sure that's the case, since it doesn't look the same as back when ramen
>> was hitting us, but there's definitely something going on. My SA cache is
>> currently at 33k and rising.
>>
>> Bill.
>>
>>
- MSDP SA explosion - sasser worm?, Bill Owens, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, Greg Shepherd, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, Bill Owens, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, David Farmer, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, Bruce Curtis, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, David Farmer, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, Doug Pearson, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, Bill Owens, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, Amel Caldwell, 05/03/2004
- Please filter TCP to 224/4 [was MSDP SA explosion - sasser worm?], Charles R. Anderson, 05/03/2004
- Re: Please filter TCP to 224/4 [was MSDP SA explosion - sasser worm?], Amel Caldwell, 05/04/2004
- Please filter TCP to 224/4 [was MSDP SA explosion - sasser worm?], Charles R. Anderson, 05/03/2004
- Re: MSDP SA explosion - sasser worm?, Bill Owens, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, William F. Maton, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, Marshall Eubanks, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, David Farmer, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, Marshall Eubanks, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, Charles R. Anderson, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, Bill Owens, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, shep, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, Bill Owens, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, William F. Maton, 05/04/2004
- Re: MSDP SA explosion - sasser worm?, Greg Shepherd, 05/03/2004
Archive powered by MHonArc 2.6.16.