Re: slapper changed to udp 1812?

On Tue, 1 Oct 2002, fingers wrote:

hi

I might be totally off the mark here, but has slapper now changed to port 1812? This'll make it really difficult to filter, if you're using this port for RADIUS.

We saw this yesterday, directed at a previously infected slapper.a (2002/udp backchannel) host on a a customer's network, and I sent the captured info to CERT to see what they made of it. I didn't know if it was the slapper communications channel, or one of the triggered DDOSs from slapper. -S