Symantec detected Slammer worm "hours" before

Peter Salus peter at matrix.net
Thu Feb 13 17:28:52 UTC 2003



I attribute this to over-zealous marketing.  As I 
mentioned at the NANOG BoF, there is, indeed, a
decrease in latency about 6 hours prior to the 
actual mass attack.  Mike Lloyd (RouteScience)
saw this, too.  There's also a decrease about 
16 hours out.  Sean suggested that they might be 
attributed to cable cuts, but I don't have the 
data to attempt correlation.

If Semantec's ouija board brought them news "hours"
earlier, they are behaving reprehensibly not to 
have alerted the community.

Peter



More information about the NANOG mailing list