From: John Beckett 

"Geo"  wrote in message
news::
> > However, if the worms were sending UDP packets to random targets instead
> > of ICMP pings, the routers would still have sent ARP broadcasts.
>
> I don't believe that's true, sqlslammer didn't generate near as much arp
> traffic as that one worm that took down our big dialup box because it would
> ping before trying to infect.
>
> but you may be right, I may be thinking of the difference between local
> subnet and remote traffic instead of icmp/udp differences.

Over here, there were thousands more pings arriving per hour than SQL UDP
packets. That probably explains the difference you saw.

There really is no difference between ICMP and UDP as far as the need to do
an ARP is concerned.

John

--- BBBS/NT v4.01 Flag-5