Detecting Blaster

Detect 135/TCP scans
Scans are against a /24 (255 hosts)
No response sent to 135/TCP SYN traffic
No active sampling
cannot differentiate variants
No 4444/TCP traffic
never respond on 135/TCP

Primitive but it works
Measure traffic and unique IPs seen