[resending from my NANOG-posting address, sigh]
I think a more interesting aspect of this particular worm is that it
only takes a single packet to infect a vulnerable host. As far as I
know no other worm can do this.
That was true prior to the March "Witty" worm.
The effect is that even packets to
broadcast or multicast address have the potential to infect.
It depends on the specifics of the server being exploited. (In Witty's
case, it was passive infection!)
I can tell you some stuff about AS12854.
Thanks!, I'll send you the list off-list.
Vern