[c-nsp] Slammer (1434) attack

[Jon Lewis]

On Wed, 22 Dec 2004, Josh Duffek wrote:

> What about adding the log keyword to the end of the ACL?  Couldn't you
> also put yourself in that vlan and sniff the wire?

Around here, systems infected with SQL Slammer would generally saturate
their 100mbit switch port.  Look for the ports receiving full line rate
traffic.

----------------------------------------------------------------------
 Jon Lewis                   |  I route
 Senior Network Engineer     |  therefore you are
 Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________