On Sat, 18 Oct 2003, S G Masood wrote: > IMHO, testing on a private network is always > preferable for highly accurate predictions.
My guess is that the msblast worm's author did do testing on a private network. I wrote a simulation of msblast that placed susceptible hosts in "bands" in a 16-bit address space. (http://www.users.qwest.net/~eballen1/nws/, section "msblast - effect of banded address space") msblast-style sequential probing does pretty well in a smaller address space that has victim hosts in blocks. That style of probing does poorly against victim hosts placed at random addresses, even in small address spaces. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html