[60550] in North American Network Operators' Group
Re: Blaster packet rates
daemon@ATHENA.MIT.EDU (Joe Provo)
Thu Aug 14 07:18:44 2003
Date: Thu, 14 Aug 2003 07:17:22 -0400
From: Joe Provo <nanog-post@rsuc.gweep.net>
To: "'nanog@merit.edu'" <nanog@merit.edu>
Reply-To: nanog-post@rsuc.gweep.net
In-Reply-To: <578F3C8F6DD3D411850600508BF320CA03A60878@aries-exch1.uk.eu.corp.vizzavi.net>
Errors-To: owner-nanog-outgoing@merit.edu
On Thu, Aug 14, 2003 at 10:17:16AM +0100, Pendergrass, Greg wrote:
[snip]
> I haven't done a long-term look at RCP and netbios traffic on the
> web so I have no way to determine how much is blaster generated,
> does anyone have baseline information on the amount of RCP and
> netbios packets were on the web before blaster was propagated?
> Alternatively, has anyone worked out the % of blaster scan as
> opposed to "normal" background RCP and netbios traffic?
Negative, but the normal background noise of netbios+friends
(including 445) is constant & at a high enough rate that on some
residential broadband networks, a pause/break in the activity
in one's filter log files is the most reliable way to detect
network outages.
--
RSUC / GweepNet / Spunk / FnB / Usenix / SAGE
