OCIPEP recommends configuring firewalls to block outgoing connection attempts to UDP port 8998, UDP 123 [NTP] and UDP ports 995, 996, 997, 998 and 999. OCIPEP also recommends that organizations block all incoming and outgoing UDP ports unless it is essential for operational purposes. If organizations cannot block UDP ports, it is critical that all UDP traffic be carefully monitored for SoBig traffic.