BIND Worm Statistics

["Crist Clark" <crist.clark () globalstar com>]

There have been a number of threads on all of the version.bind queries
flying around on the net. As most people who read this list know, this 
activity is generally attributed to worms. I while back, I posted some
statistics showing the dramatic increase in version.bind queries that
I have seen coming in to the networks I monitor. I just wanted to send 
out an update and see if anyone else out there has interesting data. I
would expect similar trends from everywhere on the Internet. To me, the
worm scanning looks pretty random.

The first attached plot (a PNG file produced with Grace-5.1.2 (aka XmGrace))
shows the number of version.bind queries coming into my networks per
day per IP address. That is, I have normalized the number of queries 
with respect to the number of IP addresses routed past the monitoring
devices. One large spike is present when someone walked a large chunk
of net sequentially (it would be possible to extract that and 
concentrate on just worm-like scans, but well, I didn't feel like it).
Note that the date labels, which go by week, are from Tuesday to Tuesday.
I like Grace, but the heck if I could convince it to move the major
tick labels to Sundays.

The second plot shows the number of packets from apparent sources. Only
the top 50 source sources are shown. There are many more, 554 to be exact.
I did not examine them all, but except for the number one entry at 1058
queries, the ones I checked showed worm-like behavior, random IPs queried
at random times over several days or weeks, as opposed to scans, quick 
walks across IP ranges.

I don't recall this list's policy on attachments, but PNGs are just a
graphic format that most browsers support, IIRC. GIFs have patent issues
and JPEGs are not really suited for this type of pic.
-- 
Crist J. Clark                                Network Security Engineer
crist.clark () globalstar com                    Globalstar, L.P.
(408) 933-4387                                FAX: (408) 933-4926

The information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.  If
the reader of this e-mail is not the intended recipient, or the employee
or agent responsible to deliver it to the intended recipient, you are
hereby notified that any review, dissemination, distribution or copying
of this communication is strictly prohibited.  If you have received this
e-mail in error, please contact postmaster () globalstar com