North American Network Operators Group
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Re: looking for Slammer infectee access link speeds
- From: Iljitsch van Beijnum
- Date: Sat May 01 20:26:16 2004
On 1-mei-04, at 20:06, vern@ee.lbl.gov wrote:
With colleagues I'm working on Internet-scale modeling of Slammer's
behavior.
Its spreading dynamics significantly differed from those of most worms,
an effect we're pretty sure is related to the fact that unlike most
worms,
an infected host's scanning often clogged the host's access link.
I think a more interesting aspect of this particular worm is that it
only takes a single packet to infect a vulnerable host. As far as I
know no other worm can do this. The effect is that even packets to
broadcast or multicast address have the potential to infect.
If one of these AS's is yours and you'd be willing to send us the
corresponding
access link speeds (ideally, as of January 2003, but if not, then
today's
will do), we'd very much appreciate it. Please send me a note and I'll
give you the list of addresses for your AS(s).
I can tell you some stuff about AS12854.
|
