citera:Starting 06:30 UTC ( 00:30 EST ) on Saturday Jan 25th 2003, worldwide traffic for port 1434 UDP increased rapidly causing major Internet links to fail. ISPs responded quickly by blocking port 1434. While traffic is still strong in some areas. It dropped significantly since its peak. About 35,000 hosts seem to be infected at this point.
Up to now, this worm has been named ´Sapphire´,´SQL-Hell´ and ´MS-SQL Slammer´.
The worm is sending a 376 byte long UDP packet to port 1434 using random targets at a very high rate. Vulnerable systems will immediately start sending identical 376 byte packets once they are infected. The worm is sending traffic to random IPs, including multicast IPs, which may improve its Denial of Service (DOS) capability.
Single ms-sql servers have been reported to generate traffic in excess of 50 MBit/sec. after being infected.