UDP Port 1434
Microsoft SQL Monitor use in monitoring Microsoft SQL Databases.
Inbound scans are typically from systems infected with the SQL Slammer worm looking for
vulnerable Microsoft SQL Servers or MSDE systems to infect. SQL Slammer has the distinction
of being the fastest worm ever released on the internet and while we were
perhaps the first to publish a notice
concerning SQL Slammer by then it was too late as SQL Slammer had compromised
most of its available victims world wide within 15 minutes.
Outbound scans if occurring in volume should be considered an indication of a
possible worm infection on the source computer and should be investigated.
PortPeeker Capture of SQLSlammer Traffic
CERT Advisory CA-2003-04 MS-SQL Server Worm
- Tools for Combating the Slammer Worm
Page last updated on
May 14, 2004