Re: looking for Slammer infectee access link speeds

[Iljitsch van Beijnum <iljitsch () muada com>]

On 1-mei-04, at 20:06, vern () ee lbl gov wrote:

> With colleagues I'm working on Internet-scale modeling of Slammer's 
> behavior.
> Its spreading dynamics significantly differed from those of most worms,
> an effect we're pretty sure is related to the fact that unlike most 
> worms,
> an infected host's scanning often clogged the host's access link.

I think a more interesting aspect of this particular worm is that it 
only takes a single packet to infect a vulnerable host. As far as I 
know no other worm can do this. The effect is that even packets to 
broadcast or multicast address have the potential to infect.

> If one of these AS's is yours and you'd be willing to send us the 
> corresponding
> access link speeds (ideally, as of January 2003, but if not, then 
> today's
> will do), we'd very much appreciate it.  Please send me a note and I'll
> give you the list of addresses for your AS(s).

I can tell you some stuff about AS12854.