BLASTER invasion !

Hi 21,
What i need to do to block BLASTER worm ?

just set
BLASTER tcp port 1024:65535 135:137
and define a rule
from any to any drop

???
something else ???
tnks

Parents

0 Pyro411_01 over 21 years ago

Blaster ports "Destination only listed"

Port 135tcp "Active Directory Chat/replication"
Port 1900tcp/udp "Universal Plug & Play"

1900 might just need to be UDP. I'll have to double check my configs.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Pyro411_01 over 21 years ago

Blaster ports "Destination only listed"

Port 135tcp "Active Directory Chat/replication"
Port 1900tcp/udp "Universal Plug & Play"

1900 might just need to be UDP. I'll have to double check my configs.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 Hellen over 21 years ago in reply to Pyro411_01

i need to block also port 1900 tcp/udp for blaster ??
why ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 bagira over 21 years ago in reply to Hellen

BLASTER comes over Port 135 tcp.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Hellen over 21 years ago in reply to bagira

what is better ...
reject or drop??

netbios ( 137-138-139 ) any to any
netbios_135 any to any
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 WaMaR over 21 years ago in reply to Hellen

Generaly better is DROP and don't log - especially on external interface,
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel