On Thu, Aug 14, 2003 at 10:17:16AM +0100, Pendergrass, Greg wrote: [snip]
I haven't done a long-term look at RCP and netbios traffic on the web so I have no way to determine how much is blaster generated, does anyone have baseline information on the amount of RCP and netbios packets were on the web before blaster was propagated? Alternatively, has anyone worked out the % of blaster scan as opposed to "normal" background RCP and netbios traffic?
Negative, but the normal background noise of netbios+friends (including 445) is constant & at a high enough rate that on some residential broadband networks, a pause/break in the activity in one's filter log files is the most reliable way to detect network outages. -- RSUC / GweepNet / Spunk / FnB / Usenix / SAGE