nanog mailing list archives
Re: looking for Slammer infectee access link speeds
From: Iljitsch van Beijnum <iljitsch () muada com>
Date: Sun, 2 May 2004 02:23:42 +0200
On 1-mei-04, at 20:06, vern () ee lbl gov wrote:
With colleagues I'm working on Internet-scale modeling of Slammer's behavior.Its spreading dynamics significantly differed from those of most worms,an effect we're pretty sure is related to the fact that unlike most worms,an infected host's scanning often clogged the host's access link.
I think a more interesting aspect of this particular worm is that it only takes a single packet to infect a vulnerable host. As far as I know no other worm can do this. The effect is that even packets to broadcast or multicast address have the potential to infect.
If one of these AS's is yours and you'd be willing to send us the corresponding access link speeds (ideally, as of January 2003, but if not, then today'swill do), we'd very much appreciate it. Please send me a note and I'll give you the list of addresses for your AS(s).
I can tell you some stuff about AS12854.
Current thread:
- looking for Slammer infectee access link speeds vern (May 01)
- Re: looking for Slammer infectee access link speeds Daniel Sheedy (May 01)
- Re: looking for Slammer infectee access link speeds Iljitsch van Beijnum (May 01)
- Re: looking for Slammer infectee access link speeds Deepak Jain (May 02)
- <Possible follow-ups>
- Re: looking for Slammer infectee access link speeds vern (May 02)
- Re: looking for Slammer infectee access link speeds vern (May 02)