Full Disclosure mailing list archives
Re: Exploring the UNKNOWN: Scanning the Internet via SNMP!
From: sub <sub () room641a net>
Date: Wed, 5 Mar 2008 08:20:21 -0500
That single UDP datagram is definitely faster. Compare the Code Red worm to Sapphire (SQL Slammer), for instance: "Previous scanning worms, such as Code Red, spread via many threads, each invoking connect() to probe random addresses. Thus each thread's scanning rate was limited by network latency, the time required to transmit a TCP-SYN packet and wait for a response or timeout. In principal, worms can compensate for this latency by invoking a sufficiently large number of threads. However, in practice, context switch overhead is significant and there are insufficient resources to create enough threads to counteract the network delays -- the worm quickly stalls and becomes latency limited. In contrast, Sapphire's scanner was limited by each compromised machine's bandwidth to the Internet. Since the SQL Server vulnerability was exploitable using a single packet to UDP port 1434, the worm was able to send these scans without requiring a response from the potential victim." * http://www.caida.org/publications/papers/2003/sapphire/sapphire.html (Oops, sorry for the copy to your inbox, Andrew.) On 3/5/08, Andrew A <gluttony () gmail com> wrote:
hey dude, how is merely sending a single datagram not going to be faster than doing an entire handshake? On Tue, Mar 4, 2008 at 12:53 AM, Sebastian Krahmer <krahmer () suse de> wrote:This is not true. I doubt there is any measurable advantage of UDP vs. TCP scans if you do it right._______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Exploring the UNKNOWN: Scanning the Internet via SNMP! Adrian P (Mar 03)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Sebastian Krahmer (Mar 04)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Adrian P (Mar 04)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Andrew A (Mar 05)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Dmitry (Mar 05)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! sub (Mar 05)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Sebastian Krahmer (Mar 05)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Enno Rey (Mar 05)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! sub (Mar 05)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! KJK::Hyperion (Mar 05)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! KJK::Hyperion (Mar 06)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Static Rez (Mar 06)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Valdis . Kletnieks (Mar 06)
- Re: Exploring the UNKNOWN: Scanning the Internet via SNMP! Sebastian Krahmer (Mar 04)