Doh! That was a typo in my original message. I meant UDP port 2001. Drew Linsalata The Gotham Bus Company Internet Server and Carrier Neutral Co-Location http://www.gothambus.com

Most of the 'I got flodoed by apache wormed machines' floods are udp/2001 not 2100... you sure its 2100 in your acls?

...

Our border ACLs are catching about three thousand UDP/2100 hits every minute tonight. Is anyone else seeing this? It seems as if ELF/Scalper-A (the Apache/FreeBSD worm) is spreading.