how to absorb affects of nachi/welchia types

[ilpadrino]

What specific equipment can be used to absorb the force of these types of worms that send so much data that your internet router is overloaded? The welchia/nachi worms probe randomly generated ip addresses for webdav vulnerabilities, using port 80. Would a PIX arrangement help?


Thanks in advance.

 

[MTandSAV]

I am not to sure what you can do on the router here, but I would try to identify the hosts infected and have them cleaned or disconnected. Creating an ACL on port 80 for the infected hosts will do, but might be a lot of work. Also I believe the infected hosts try other ports as well.

 

[ilpadrino]

I agree that workstations need to stay clean, but not all clients are manageable. I was just wondering if there is equipment available that will keep the internet running for the rest of the network while getting flooded by the worm.