As the worm turns, Slapper variants begin using UDP ports 4156 and 1978 (instead of 2002)

H. Morrow Long morrow.long at
Sun Sep 22 19:31:16 GMT 2002

Several (see have noticed
Slapper using UDP port 4156 today (and apparently yesterday as well
as I can see from netflow logs).

I've also noticed a Slapper variant apparently using UDP port 1978
today as well (one of our hosts on which Slapper is no longer active
is continuing to receive UDP packets to and from port 1978 from many
of your institutions...).

H. Morrow Long
University Information Security Officer
Director, Information Security Office
Yale University, ITS

More information about the unisog mailing list