Loading...
[get complete service list]
Top of page
Top of page
Port Information
Protocol Service Name
tcp ms-sql-m Microsoft-SQL-Monitor
udp ms-sql-m SQL Slammer / Sapphire worm
Top IPs Scanning
Today Yesterday
192.46.234.253 (65)190.211.252.18 (590)
187.217.186.28 (23)128.232.21.75 (461)
80.76.51.89 (18)192.46.234.253 (446)
146.71.50.197 (16)146.88.241.219 (312)
64.62.156.49 (16)142.93.57.185 (298)
145.239.255.60 (16)146.88.241.173 (120)
51.77.153.15 (13)146.88.241.76 (64)
64.62.156.45 (13)185.194.216.149 (62)
64.62.156.40 (13)79.124.58.18 (47)
54.39.118.53 (12)187.188.191.199 (44)
User Comments
Submitted By Date
Comment
Rivaldo Oliveira 2011-12-24 02:07:39
I have observed a significant increase in traffic on port 1434 in the last days, someone has something new about a new variant of the slammer? thank you Rivaldo Oliveira
Stephen Kawamoto 2009-10-04 18:45:22
I looked over eeye.com's reverse engineering of the worm that did the SQL Slammer (given the name, "Sapphire Worm") on Jan. 25, and it's elegant, not quick and dirty. Reference: http://www.eeye.com/html/Research/Flash/sapphire.txt
Marcus H. Sachs, SANS Institute 2003-10-10 00:35:20
SANS Top-20 Entry: W2 Microsoft SQL Server (MSSQL) http://isc.sans.org/top20.html#w2 The Microsoft SQL Server (MSSQL) contains several serious vulnerabilities that allow remote attackers to obtain sensitive information, alter database content, compromise SQL servers, and, in some configurations, compromise server hosts. MSSQL vulnerabilities are well-publicized and actively under attack. Two recent MSSQL worms in May 2002 and January 2003 exploited several known MSSQL flaws. Hosts compromised by these worms generate a damaging level of network traffic when they scan for other vulnerable hosts.
Johannes Ullrich 2003-01-26 22:05:40
This port is used by the SQL Slammer or Sapphire worm. See 'analysis' section on homepage. Worm started at 12:30 AM January 25th. It is targeting MS-SQL servers on port 1434 (UDP).
David Berg 2003-01-25 20:33:56
Observed 30 probes in 30 minutes from 30 sources -- all source port 69 to destination 1434 UDP. Probes continuing as I write this at the same pace. First probe at 21:35 Pacific time.
Top of page
CVE Links
CVE # Description
Top of page