On Sat, Feb 01, 2003 at 01:54:36PM +0100, Simon Richter wrote: > Hi, > > > According to the analysis posted to NANOG by a number of > > researchers (http://www.caida.org/analysis/security/sapphire/), > > It infected the majority of hosts within the first 10 minutes. > > [...] > > > This seems important is because it shows that a high rate > > of saturation can be achieved among network nodes as > > effectively (if not more so) using random distribution, as by > > using a structured or hierarchical distribution strategy. > > Actually, that was what the worm author did. The algorithm generates new > numbers from the current (i.e. it has some sort of knowledge what hosts > have already been infected) plus a not-really-predictable component > (system time, IIRC) plus some sort of counter because the system clock > is so slow. > > So what we have witnessed is the structured approach. The question > remains whether the worm author is a maths wizard or just plain lucky.
Using a random distribution is easier to code than another kind. Plus, if you use a hierarchical way, you'd better be a REALLY good math wizz to make sure 2 worms won't cover the same ip-range. Using a random distribution is the best no-brainer way to make sure having 500 worms will produce a 500 times wider coverage. PS:what you're describing looks like a pseudo random generator ... doesn't look like a structured approach. Do you have a link to that generator description? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
