The MS-SQL worm: lessons for free software

The MS-SQL worm: lessons for free software

Posted Feb 6, 2003 17:58 UTC (Thu) by pflugstad (subscriber, #224)
In reply to: The MS-SQL worm: lessons for free software by AnswerGuy
Parent article: The MS-SQL worm: lessons for free software

Note that in order for connection rate limiting to have helped in the case of SQL Slammer, it would have had to limit UDP packets, as SQL Slammer used UDP. Not impossible, but unlikey.

I totally agree with you otherwise.

On a seperate note, the major reason SQL Slammer propagated as fast as it did was because it was UDP based. This let each infected host send probes to 100's or even 1000's of IP addresses each SECOND. It didn't have to wait for the normal TCL 3-way handshake to go on, dramatically increasing it's ability to spread.

Pete

---

(Log in to post comments)