Full Disclosure mailing list archives
Re: interesting?
From: "Berend-Jan Wever" <SkyLined () edup tudelft nl>
Date: Sat, 1 Feb 2003 10:54:31 +0100
I think this is significant as it could offer some insight into whether it is more efficient or economical (fewer iterations?) to distribute mobile or replicating information into a network in a controlled vs. a random way. To me, it's eerily similar to the question of how to distribute vulnerability information most effectively in a system of interconnected administrators. Randomly seems to have worked quite well this time around.
If it would not have had a random scanning engine but would have scanned all "possible" IP addresses one by one(256*256*256*256=4,294,967,296 possible targets), at 55 million scans per second it would take 78 seconds for it to scan them all. The way I see it, it's randomness seems to have hampered it. <quote> The worm achieved its full scanning rate (over 55 million scans per second) after approximatly three minutes, after which the rate of growth slowed down somewhat because significant portions of the network did not have enough bandwidth to allow it to operate unhindered. </quote> Berend-Jan Wever _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- interesting? batz (Jan 31)
- Re: interesting? Berend-Jan Wever (Feb 01)
- Re: interesting? Ka (Feb 01)
- Re: interesting? Simon Richter (Feb 01)
- Re: interesting? Simon Marechal (Feb 01)
- Re: interesting? Simon Richter (Feb 01)
- Re: interesting? Simon Marechal (Feb 01)
- Re: interesting? Roland Postle (Feb 01)
- Re: interesting? Geoincidents (Feb 01)
- Re: interesting? Simon Marechal (Feb 01)
- Re: interesting? Berend-Jan Wever (Feb 01)
- Re: interesting? batz (Feb 01)
- Re: interesting? Gregory Steuck (Feb 01)