all groups > sql server connect > march 2004 >
You're in the

sql server connect

group:

UDP Port 1434 Blocking


UDP Port 1434 Blocking Wayne
3/30/2004 12:19:52 PM
sql server connect:
In order to protect from 'slammer' kind of virus, we are
planning to block UDP Port 1434 on all gateways. Named
instances seem to rely on UDP Port 1434. Since TCP port
the sql instance is listening on can be re-assigned, Can
we reassign the UDP port 1434 as well? Any input will be
appreciated. Thank you!
RE: UDP Port 1434 Blocking Mark Allison
4/1/2004 2:31:05 AM
Wayne

You can define a static port for each named instance using the server network utility and then reconfigure your clients to point to this IP address:port. You cannot use dynamic ports if UDP 1434 is blocked

-
Mark Allison, SQL Server MV
http://www.markallison.co.u
RE: UDP Port 1434 Blocking Wayne
4/1/2004 9:35:06 AM
Thank you, Mark.
[quoted text, click to view]
using the server network utility and then reconfigure your
clients to point to this IP address:port. You cannot use
dynamic ports if UDP 1434 is blocked.
[quoted text, click to view]
RE: UDP Port 1434 Blocking cgross NO[at]SPAM online.microsoft.com
4/2/2004 5:41:38 PM
For more information on static and dynamic ports, see:
823938 How to use static and dynamic port allocation in SQL Server 2000
http://support.microsoft.com/?id=823938

Also, I want to explicitly answer the question about whether you can change
the UDP 1434 port to something else - the answer is no. However, if all
instances of SQL Server and MSDE in your network are patched to SP3 or
higher then you are not vulnerble to Slammer.

Cindy Gross, MCDBA, MCSE
http://cindygross.tripod.com
This posting is provided "AS IS" with no warranties, and confers no rights.
Re: UDP Port 1434 Blocking Mike Singer
4/12/2004 7:36:35 AM
We have also blocked UDP 1434 and have to set up aliases on all the client
workstations for named instances. I would like to address the comment

"However, if all
[quoted text, click to view]
"

That is a little like saying if all the other kids in the world are
innoculated against diseases, you don't need to get your kid innoculated.
This is an insidious worm that can take down a network. We have seen home
users VPN'ed to our network cause massive data storms. Unpatched MSDE's go
up all the time since MSDE comes included w/ so many applications. Anyone
who does not block UDP 1434 at the switch level for every network that they
consider important is being extremely delinquent IMHO. This is clearly a
case of an incredibly useful feature (named Instances) being damanged
long-term by after the fact, security management.


[quoted text, click to view]

AddThis Social Bookmark Button