SANS had a decent writeup on this here (work in progress):

http://isc.sans.org/diary.html?date=2003-10-01