Worm / UDP1434

Anybody here on list using Extreme products (Summit/Alpine/Blackdiamond)?
They sure don't like this traffic one bit. It causes them to not only drop
traffic, but spew out every available error message under the sun...

Extreme are apparently assembling an "advisory TAC" on this, from our point
of view, since we use the devices to do l3 aggregation (for colo and such)
we've used an ACL to try and combat the offending traffic, but its not doing
much good.....

Do you have MCAST enabled on these switches? I'd guess this
is what is causing issues on the extreme boxes.

I think the architecture is flow-based, ie, the first packet of each flow
hits the CPU. This is probably causing the high CPU utilization. The flow
would still hit the CPU even with a ACL and then probably be written to
the ASIC with a null location.