RE: [Full-Disclosure] AT&T early warning system

["Bruce Ediger" <eballen1@qwest.net>]

On Sat, 18 Oct 2003, S G Masood wrote:

> IMHO, testing on a private network is always
> preferable for highly accurate predictions.

My guess is that the msblast worm's author did do testing on a private
network.  I wrote a simulation of msblast that placed susceptible hosts
in "bands" in a 16-bit address space.
(http://www.users.qwest.net/~eballen1/nws/, section "msblast - effect of
banded address space")

msblast-style sequential probing does pretty well in a smaller address
space that has victim hosts in blocks.  That style of probing does poorly
against victim hosts placed at random addresses, even in small address
spaces.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html