Re: SNMP worm?

Hi there,

There was an instance last month that we got some suspicious SNMP
traffic. Was the activity similar to something like this?

http://www.philippinehoneynet.org/charts_2005-09-25/snort-pscin_signature_daily_attacks_radar_216.254.95.40_2005-09-25.gif

http://www.philippinehoneynet.org/dataarchive.php?date=2005-09-25

At that time I did not think it was a worm but now you've said it I
might go back to the logs to look at it.

Regards,
Ryan Talabis
Philippine Honeynet Project
http://www.philippinehoneynet.org



On 10/27/05, David Gillett <[email protected]> wrote:
>  We're suddenly seeing a lot of unauthorized SNMP traffic, including
> some to broadcast destinations, from stations on our network that have
> no business doing that.  Anyone know of a new virus/worm with that
> behaviour?  (Details are still sketchy here -- I'm hoping someone else
> has seen this and can provide clues of additional symptoms to look for.)
>
> David Gillett
>
>
>