The honeynet folks sent us a link to their research on the MSDTC exploit that is attacking TCP port 1025 (the Dasher worms).  This is very interesting stuff, especially if you like statistical analysis:
http://www.philippinehoneynet.org/dataarchive.php?date=2005-12-13

UPDATE: the bandwidth for philippinehoneynet.org has been exceeded.  Does anyone have a mirror to offer?