Sortta OT: How do I see "Win32.Worm.Allaple.Gen" traffic in my Linux firewall?

[James Finstrom]

Looks like it does a tcp scan on 139 and 445

On 5/19/10, kitepilot at kitepilot.com <kitepilot at kitepilot.com> wrote:
> Hello World:
> Long story short:
> I got an "official" notification that a computer behind my Linux firewall
> has the "Win32.Worm.Allaple.Gen" virus.
>
> I have some 150 puters NAT(ed) behind that firewall and no access whatsoever
> to any of them.
>
> Question is:
> What can I do at the Firewall level to identify the virus' traffic so I can
> harvest the puter's IP address...
> Thanks!
> ET
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>

-- 
Sent from my mobile device

James Finstrom
Rhino Equipment Corp.
http://rhinoequipment.com ~ http://postug.com
Phone: 1-877-RHINO-T1 ~ FAX: +1 (480) 961-1826
Twitter: http://twitter.com/rhinoequipment
IP: guest at asterisk.rhinoequipment.com