[70136] in North American Network Operators' Group
Re: looking for Slammer infectee access link speeds
daemon@ATHENA.MIT.EDU (vern@ee.lbl.gov)
Sun May 2 11:31:44 2004
From: vern@ee.lbl.gov
To: Iljitsch van Beijnum <iljitsch@muada.com>
Cc: nanog@merit.edu
Date: Sun, 02 May 2004 08:31:10 -0700
Errors-To: owner-nanog-outgoing@merit.edu
[resending from my NANOG-posting address, sigh]
> I think a more interesting aspect of this particular worm is that it
> only takes a single packet to infect a vulnerable host. As far as I
> know no other worm can do this.
That was true prior to the March "Witty" worm.
> The effect is that even packets to
> broadcast or multicast address have the potential to infect.
It depends on the specifics of the server being exploited. (In Witty's
case, it was passive infection!)
> I can tell you some stuff about AS12854.
Thanks!, I'll send you the list off-list.
Vern
