Question about Dynamic Graphs of the Nimda worm

Wed Sep 19 21:31:15 UTC 2001

The Dynamic Graphs of the Nimda worm at

    http://www.caida.org/dynamic/analysis/security/nimda/

are interesting. To what degree do the graphs really tell us how many 
hosts are infected? Or do they just tell us how many infected hosts 
are observed every 15 minutes?  I guess what I am asking is, is the 
15 minute sample period causing the graph to under report the total 
number of infected sites? How likely is it that the CAIDA monitor 
will be visited at least once every 15 minutes by an infected system? 
No matter what the answer to this question is, I do like the fact 
that the trend is down.

    -Jeff Ogden
     Merit