Re: looking for Slammer infectee access link speeds
2 May
2004
2 May
'04
11:35 a.m.
I think this is really the most important point. Link speeds and such are not as significant, maximum packet rates probably are.
Where link rates become key is in modeling the worm's dynamics. Because often a single infected machine could fill an access link, additional infections behind that same link didn't change the worm's overall scanning rate; this is unlike other, non-"bandwidth-limited" worms, and changes Slammer's growth to not be the usual exponential/logistic curve. See our paper on Slammer for more details: http://www.computer.org/security/v1n4/j4wea.htm We're now trying to explore that effect, which requires knowing what those bottleneck bandwidth rates were for sets of hosts behind a common bottleneck. Vern
7558
Age (days ago)
7558
Last active (days ago)
0 comments
1 participants
participants (1)
-
vern@ee.lbl.gov