All things related to multicast

[Joel Jaeggli <>]

one would expect that it was due to udp packets sourced into the beacon 
group, from locations with multicast connectivity such as the UO...

given that sapphire was using a prng to pick the destination I'd expect 
the amount of state generated to be smaller and less sustained than say 
the ramen worm (which would periodically scan large pieces of multicast 
address space)... but with ~78000 hosts randomly scanning the entire v4 
address space the distribution of msdp state should be fairly even across 
the entire multicast address space, spurious packets would only show 
up in groups where there are actual joiners (ie one packet is the source 
on an abritrary group is argueably the cannonical bursty source) already 
creating state in the network.

joelja

On Mon, 3 Feb 2003, Marshall Eubanks wrote:

> Does anyone know why in detail the Sapphire worm response
> created so many "Client ID only" entries on the beacon web view at
> 
> http://beaconserver.accessgrid.org:9999/  ,
> 
> who actually did this, and whether continuing to do it is a reasonable
> response to the worm ?
> 
> Note that sites like Montana.edu seem to be totally off the air now.
> 
>                                   Regards
>                                   Marshall Eubanks
> 
> 
> T.M. Eubanks
> Multicast Technologies, Inc.
> 10301 Democracy Lane, Suite 410
> Fairfax, Virginia 22030
> Phone : 703-293-9624       Fax     : 703-293-9609
> e-mail : 
> 
> http://www.multicasttech.com
> 
> Test your network for multicast :
> http://www.multicasttech.com/mt/
>   Status of Multicast on the Web  :
>   http://www.multicasttech.com/status/index.html
> 

-- 
-------------------------------------------------------------------------- 
Joel Jaeggli          Academic User Services   

    
--    PGP Key Fingerprint: 1DE9 8FCA 51FB 4195 B42A 9C32 A30D 121E      --
  In Dr. Johnson's famous dictionary patriotism is defined as the last
  resort of the scoundrel.  With all due respect to an enlightened but
  inferior lexicographer I beg to submit that it is the first.
                            -- Ambrose Bierce, "The Devil's Dictionary"