SQL Slammer hits

Is anyone else seeing a spike in SQL Slammer worm hits on their perimeter?

I have 124 uniques hosts hitting me with 533 events. This is particularly high and my guess is that it might be tied to a worm we discovered in the wild earlier this week.

--Th13

I've been getting 300+ MS-SQL worm attempts for a week or two now. Don't know or care if it's Slammer or not since I don't have the ports open to the world. I've had 290 in the last 24 hours.

Quote:

---

Originally posted here by thehorse13
Is anyone else seeing a spike in SQL Slammer worm hits on their perimeter?

I have 124 uniques hosts hitting me with 533 events. This is particularly high and my guess is that it might be tied to a worm we discovered in the wild earlier this week.

--Th13

---

I hear ya Horse, I have seen A LOT of activity for well over a week now.

Now excuse me while I go hug my firewall. :D

Cheers:

Thanks fellas,

My firewall is tighter than a frog's ass in water. I was just curious if others were getting fired at by this. It was more to satisfy my curiousity than anything else. There is no way it's gettin in here!

:)

Quote:

---

There is no way it's gettin in here!

---

Yep.... and pride cometh before a fall..... You don't have that admin writing any other scripts do you.... or changing firewalls...... ;)

My Snort logs show...

Yesterday: 49 unique hosts, 80 hits
Past 7 days: 249 unique hosts, 536 hits with about 10 hosts hitting 10-15 times.

Mostly normal

Hahahah, no sir. He is not part of our operation, thus, the world is a safer place. ;)

Firewalls can do some good even if you don't think it would ;)

Sorry, don't have access to current stats... but I can tell you that the last 3 days of July, the corporate HQ dmz sensor triggered 1394 events (tcp1434) from 300 unique hosts. It's up a little bit, but we see it all the time at this client's site.

I still stick by what I posted earlier...
http://www.antionline.com/showthread...138#post852138