Re: Blaster packet rates

[Joe Provo <nanog-post () rsuc gweep net>]

On Thu, Aug 14, 2003 at 10:17:16AM +0100, Pendergrass, Greg wrote:
[snip]
> I haven't done a long-term look at RCP and netbios traffic on the 
> web so I have no way to determine how much is blaster generated, 
> does anyone have baseline information on the amount of RCP and 
> netbios packets were on the web before blaster was propagated? 
> Alternatively, has anyone worked out the % of blaster scan as 
> opposed to "normal" background RCP and netbios traffic?

Negative, but the normal background noise of netbios+friends 
(including 445) is constant & at a high enough rate that on some 
residential broadband networks, a pause/break in the activity 
in one's filter log files is the most reliable way to detect 
network outages.

-- 
             RSUC / GweepNet / Spunk / FnB / Usenix / SAGE