North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: looking for Slammer infectee access link speeds

  • From: Iljitsch van Beijnum
  • Date: Sat May 01 20:26:16 2004 
On 1-mei-04, at 20:06, [email protected] wrote:
With colleagues I'm working on Internet-scale modeling of Slammer's behavior.
Its spreading dynamics significantly differed from those of most worms,
an effect we're pretty sure is related to the fact that unlike most worms,
an infected host's scanning often clogged the host's access link.
I think a more interesting aspect of this particular worm is that it only takes a single packet to infect a vulnerable host. As far as I know no other worm can do this. The effect is that even packets to broadcast or multicast address have the potential to infect.

If one of these AS's is yours and you'd be willing to send us the corresponding
access link speeds (ideally, as of January 2003, but if not, then today's
will do), we'd very much appreciate it. Please send me a note and I'll
give you the list of addresses for your AS(s).
I can tell you some stuff about AS12854.