From: Iljitsch van Beijnum (no email)
Date: Sat May 01 2004 - 20:23:42 EDT
On 1-mei-04, at 20:06, wrote:
> With colleagues I'm working on Internet-scale modeling of Slammer's
> behavior.
> Its spreading dynamics significantly differed from those of most worms,
> an effect we're pretty sure is related to the fact that unlike most
> worms,
> an infected host's scanning often clogged the host's access link.
I think a more interesting aspect of this particular worm is that it
only takes a single packet to infect a vulnerable host. As far as I
know no other worm can do this. The effect is that even packets to
broadcast or multicast address have the potential to infect.
> If one of these AS's is yours and you'd be willing to send us the
> corresponding
> access link speeds (ideally, as of January 2003, but if not, then
> today's
> will do), we'd very much appreciate it. Please send me a note and I'll
> give you the list of addresses for your AS(s).
I can tell you some stuff about AS12854.
|
|
|