Now suppose a new worm breaks out. The feature of the worm is:

It targets TCP port $8008$ or UDP port $4004$

It contains the signature $030$E FE CC A$0$ follow by $$PASS : RECV$$ within the $20$ bytes of the first one.

The worm is coming from outside of our network $($Our network is on $129\mathrm{.}105\mathrm{.}100\mathrm{.}0/24).$