Campus network slowdown: hosts scanning port 445 to be blocked

   Forwarding an announcement from Ken Lindahl of IST-CNS, noting
performance problems occurring today with the campus network backbone
due to scanning of port 445 by campus hosts, activity which may be
associated with the "Sasser" worm or other worms.

   Ken writes, in part:

>CNS has requested that SNS immediately block any campus hosts that
>have been detected scanning port 445. we expect to implement those
>blocks very soon,

FYI.

Aron Roberts
Workstation Software Support Group

---begin forwarded text---

>Date: Tue, 4 May 2004 15:46:26 -0700 (PDT)
>From: owner-ucb-net-announce@listlink.berkeley.edu
>X-Authentication-Warning: uclink-store.berkeley.edu: majordom set
>sender to owner-ucb-net-announce@listlink.berkeley.edu using -f
>To: ucb-net-announce@listlink.berkeley.edu
>Organization: Communication & Network Services
>Subject: [UCB-NET-ANNOUNCE] EMERGENCY ANNOUNCEMENT campus-wide May
>4, 2004 10:00am - now
>Sender: owner-ucb-net-announce@listlink.berkeley.edu
>Precedence: junk
>Reply-To: nobody@uclink4.berkeley.edu
>
>[...]
>
>EMERGENCY ANNOUNCEMENT campus-wide May 4, 2004 10:00am - now
>
>Equipment: backbone routers
>Location: campus-wide
>Date: May 4, 2004 Start: 10:00am End: now
>
>Description:
>the campus backbone is currently experiencing wide-spread
>performance problems because of a dramatic increase in port
>445 scanning by campus hosts, starting approx 10:00am today.
>CNS suspects a substantial fraction of this scanning is from
>campus hosts infected with the "sasser" or some other worm.
>accordingly, CNS has requested that SNS immediately block any
>campus hosts that have been detected scanning port 445. we
>expect to implement those blocks very soon, and hope this will
>substantially mitigate the performance problems on campus.
>
>ken lindahl
>CNS
>C

---end forwarded text---

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.
Received on Tue May 4 16:02:41 2004