RE: SNMP worm?

David,
 
None here (yet). Possible a contractor or vendor showing off network
solution-wares? Does it appear to be polling sequentially or
randomly? Is it looking through particular subnets? Is it possibly a
new printer(s) that have been plugged in or gone wild?
 
This is probably a duh question, but have you been able to
hunt down the offending workstation(s) and check them out?
 
I'll keep on the lookout.
 
Best of Luck.
Robert

________________________________

From: David Gillett [mailto:[email protected]]
Sent: Wed 10/26/2005 4:56 PM
To: [email protected]
 
We're suddenly seeing a lot of unauthorized SNMP traffic, including
some to broadcast destinations, from stations on our network that have
no business doing that.  Anyone know of a new virus/worm with that
behaviour?  (Details are still sketchy here -- I'm hoping someone else
has seen this and can provide clues of additional symptoms to look for.)

David Gillett