Re: CRv2 multiple scans from same source IP

From: Valdis.Kletnieksat_private
Date: Sun Aug 05 2001 - 20:23:00 PDT

Next message: Ben N. Venzke: "CodeRedII attempts from Cable/DSL/dial-ups"

Previous message: Deterding, Brent D: "CodeRedII variant - smaller size now?"
In reply to: John Davidson: "CRv2 multiple scans from same source IP"
Next in thread: robhat_private: "RE: CRv2 multiple scans from same source IP"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Sun, 05 Aug 2001 20:39:14 EDT, John Davidson <jwd_odsat_private>  said:

> The IP is outside my Class A address space. From the analysis of CRv2
> published at www.eeye.com this should not be possible, or at least the
> likelihood of such an occurence is much greater than winning a very big
> lottery... I should maybe buy a ticket! ;-).

The odds of winning a large lottery are usually on the order of 1 per million.

A million tickets sold is a *lot*.  A million probes is *nothing*.  Figure out
how many scans/second 10,000 hosts with CodeRedII (which has 300-600 non-blocking
threads) will produce...

At that rate, you dont NEED a very high chance of popping into a new /8 or /16. ;)
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

application/pgp-signature attachment: stored

Next message: Ben N. Venzke: "CodeRedII attempts from Cable/DSL/dial-ups"
Previous message: Deterding, Brent D: "CodeRedII variant - smaller size now?"
In reply to: John Davidson: "CRv2 multiple scans from same source IP"
Next in thread: robhat_private: "RE: CRv2 multiple scans from same source IP"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Aug 05 2001 - 21:48:00 PDT