mailing list archives
Re: Blaster packet rates
From: Joe Provo <nanog-post () rsuc gweep net>
Date: Thu, 14 Aug 2003 07:17:22 -0400
On Thu, Aug 14, 2003 at 10:17:16AM +0100, Pendergrass, Greg wrote:
I haven't done a long-term look at RCP and netbios traffic on the
web so I have no way to determine how much is blaster generated,
does anyone have baseline information on the amount of RCP and
netbios packets were on the web before blaster was propagated?
Alternatively, has anyone worked out the % of blaster scan as
opposed to "normal" background RCP and netbios traffic?
Negative, but the normal background noise of netbios+friends
(including 445) is constant & at a high enough rate that on some
residential broadband networks, a pause/break in the activity
in one's filter log files is the most reliable way to detect
RSUC / GweepNet / Spunk / FnB / Usenix / SAGE