[nsp-sec] [EXTERNAL] Re: 9001: New UDP amplification port?

[Dobbins, Roland]

> On 15 Jul 2021, at 22:27, Compton, Rich A <Rich.Compton at charter.com> wrote:
> 
> I have started seeing spikes in UDP port 9001 today that could be DDoS amp traffic.

It turns out that there are apparently multiple vectors which can be exploited for reflection/amplification on UDP/9001.  This part is TLP: AMBER, for now.
--------------------------------------------
Roland Dobbins <roland.dobbins at netscout.com>