Joe Maimon wrote:
Is there still justification for denying transit for ms-sql slammer ports?
Thanks,
Joe
Thanks all for your responses. To me it appears that
a) If you block 135/445 you should block slammer as well
b) If the number of potential infected hosts connected to your network can threaten your service, you should block.
c) If you are more concerned about eliminating crap on the net than in accomodating every whim of your users and are not doing pure transit, block it.
d) Microsoft should consider migrating to a new port for sql server.
e) if you are doing pure transit and not blocking anything, nobody will expect you to block slammer either.
f) slammers half life is incredibly long
Does anybody have any idea of the rate of NEW slammer infections?
Thanks, Joe
