Sorry Tmor, I don't quite get what you mean with "catching" and "on the ASL itself" .. Since the Blaster/Lovesan worm are using Windows RPC wulnerability to spread, there will be no notification from the AV tool or anything else. But, in general, the ports 135, 139 & 445 will be rejected & logged. Regarding those ports, we received following amount of attempts to these ports during August so far: 135/ 1000+, 139/ 500+, 445/ 2000+. I have not analyzed this from earlier months, so I don't know if there's any increase.
I have several attempts of both worms hitting the firewall and getting dropped(and logged)..the storms average 309k packets totalling 15 megs of data every incident..if you want logs just let me know..
I have several attempts of both worms hitting the firewall and getting dropped(and logged)..the storms average 309k packets totalling 15 megs of data every incident..if you want logs just let me know..
