North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Re: looking for Slammer infectee access link speeds
- From: Iljitsch van Beijnum
- Date: Sat May 01 20:26:16 2004
On 1-mei-04, at 20:06, firstname.lastname@example.org wrote:
With colleagues I'm working on Internet-scale modeling of Slammer's
I think a more interesting aspect of this particular worm is that it
only takes a single packet to infect a vulnerable host. As far as I
know no other worm can do this. The effect is that even packets to
broadcast or multicast address have the potential to infect.
Its spreading dynamics significantly differed from those of most worms,
an effect we're pretty sure is related to the fact that unlike most
an infected host's scanning often clogged the host's access link.
If one of these AS's is yours and you'd be willing to send us the
access link speeds (ideally, as of January 2003, but if not, then
will do), we'd very much appreciate it. Please send me a note and I'll
give you the list of addresses for your AS(s).
I can tell you some stuff about AS12854.