full-disclosure - Re: Exploring the UNKNOWN: Scanning the Internet via SNMP!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 5 Mar 2008 08:20:21 -0500
From: sub <sub@...m641a.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Exploring the UNKNOWN: Scanning the Internet
	via SNMP!

That single UDP datagram is definitely faster. Compare the Code Red
worm to Sapphire (SQL Slammer), for instance:

"Previous scanning worms, such as Code Red, spread via many threads,
each invoking connect() to probe random addresses. Thus each thread's
scanning rate was limited by network latency, the time required to
transmit a TCP-SYN packet and wait for a response or timeout. In
principal, worms can compensate for this latency by invoking a
sufficiently large number of threads. However, in practice, context
switch overhead is significant and there are insufficient resources to
create enough threads to counteract the network delays -- the worm
quickly stalls and becomes latency limited.

In contrast, Sapphire's scanner was limited by each compromised
machine's bandwidth to the Internet. Since the SQL Server
vulnerability was exploitable using a single packet to UDP port 1434,
the worm was able to send these scans without requiring a response
from the potential victim."

* http://www.caida.org/publications/papers/2003/sapphire/sapphire.html

(Oops, sorry for the copy to your inbox, Andrew.)

On 3/5/08, Andrew A <gluttony@...il.com> wrote:
> hey dude, how is merely sending a single datagram not going to be faster
> than doing an entire handshake?
>
> On Tue, Mar 4, 2008 at 12:53 AM, Sebastian Krahmer <krahmer@...e.de> wrote:
>
> > This is not true. I doubt there is any measurable advantage
> > of UDP vs. TCP scans if you do it right.
> >
> >
>
>
> _______________________________________________
>  Full-Disclosure - We believe in it.
>  Charter:
> http://lists.grok.org.uk/full-disclosure-charter.html
>  Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/