UDP Port 1434

Common Use

Microsoft SQL Monitor use in monitoring Microsoft SQL Databases.

Inbound Traffic

Inbound scans are typically from systems infected with the SQL Slammer worm looking for vulnerable Microsoft SQL Servers or MSDE systems to infect.  SQL Slammer has the distinction of being the fastest worm ever released on the internet and while we were perhaps the first to publish a notice concerning SQL Slammer by then it was too late as SQL Slammer had compromised most of its available victims world wide within 15 minutes.

Outbound Traffic

Outbound scans if occurring in volume should be considered an indication of a possible worm infection on the source computer and should be investigated.

Additional Information

PortPeeker Capture of SQLSlammer Traffic

CERT Advisory CA-2003-04 MS-SQL Server Worm

Microsoft - Tools for Combating the Slammer Worm

Page last updated on May 14, 2004