Symantec detected Slammer worm "hours" before
Peter Salus
peter at matrix.net
Thu Feb 13 17:28:52 UTC 2003
I attribute this to over-zealous marketing. As I
mentioned at the NANOG BoF, there is, indeed, a
decrease in latency about 6 hours prior to the
actual mass attack. Mike Lloyd (RouteScience)
saw this, too. There's also a decrease about
16 hours out. Sean suggested that they might be
attributed to cable cuts, but I don't have the
data to attempt correlation.
If Semantec's ouija board brought them news "hours"
earlier, they are behaving reprehensibly not to
have alerted the community.
Peter
More information about the NANOG
mailing list