[70133] in North American Network Operators' Group
Re: looking for Slammer infectee access link speeds
daemon@ATHENA.MIT.EDU (Iljitsch van Beijnum)
Sat May 1 20:24:36 2004
In-Reply-To: <200405011806.i41I6sCq045648@jaguar.icir.org>
Cc: nanog@merit.edu
From: Iljitsch van Beijnum <iljitsch@muada.com>
Date: Sun, 2 May 2004 02:23:42 +0200
To: vern@ee.lbl.gov
Errors-To: owner-nanog-outgoing@merit.edu
On 1-mei-04, at 20:06, vern@ee.lbl.gov wrote:
> With colleagues I'm working on Internet-scale modeling of Slammer's
> behavior.
> Its spreading dynamics significantly differed from those of most worms,
> an effect we're pretty sure is related to the fact that unlike most
> worms,
> an infected host's scanning often clogged the host's access link.
I think a more interesting aspect of this particular worm is that it
only takes a single packet to infect a vulnerable host. As far as I
know no other worm can do this. The effect is that even packets to
broadcast or multicast address have the potential to infect.
> If one of these AS's is yours and you'd be willing to send us the
> corresponding
> access link speeds (ideally, as of January 2003, but if not, then
> today's
> will do), we'd very much appreciate it. Please send me a note and I'll
> give you the list of addresses for your AS(s).
I can tell you some stuff about AS12854.
