[resending from my NANOG-posting address, sigh] > I think a more interesting aspect of this particular worm is that it > only takes a single packet to infect a vulnerable host. As far as I > know no other worm can do this.
That was true prior to the March "Witty" worm. > The effect is that even packets to > broadcast or multicast address have the potential to infect. It depends on the specifics of the server being exploited. (In Witty's case, it was passive infection!) > I can tell you some stuff about AS12854. Thanks!, I'll send you the list off-list. Vern