Warning -- floods of Allaple worm alerts.... sid:200329(2-5)

Hi

Over the last 24 hours we have had about 50 sources fire 20 million ping
packets containing the string that triggers the Allaple signature.  The
only affect it has has is to gum up my snort database.   I don't believe
this is worm traffic and if is a ddos it is pretty feeble.  It was
however a fairly effective dos against my snort system -- two sensors
saw this traffic so that's a total of over 40 million events in the
database.  :(

I have now disabled all those rules and am (slowly) deleting all the
records from the data base.   Can I suggest that these rules be disabled
by default with a comment saying why.

Anyone got any idea why this traffic was sent (I doubt if they were
really trying to attack my snort system).   They have sent enough
traffic to random addresses to map our network 200 times over.

Russell.