^ Top

NANOG Meeting Presentation Abstract

The Spread of the Sapphire/Slammer Worm
Meeting: NANOG27
Date / Time: 2003-02-10 9:15am - 9:45am
Room: Anasazi Ballroom
Presenters: Speakers:
David Moore, CAIDA & UCSD CSE.
Vern Paxson, ICIR & LBNL.
Stefan Savage, UCSD CSE.
Colleen Shannon, CAIDA.
Stuart Staniford, Silicon Defense.
Nicholas Weaver, Silicon Defense & UC Berkeley EECS.
Abstract: We have completed our preliminary analysis of the spread of the Sapphire/Slammer SQL worm. This worm required rougly 5 minutes to spread worldwide, making it by far the fastest worm to date. In the early stages the worm doubled in size every 8.5 seconds. At its peak, achieved approximately 3 minutes after it was released, Sapphire scanned the net at over 55 million IP addresses per second. It infected at least 75,000 victims and probably considerably more.

This remarkable speed, nearly two orders of magnitude faster than Code Red, was the result of a bandwidth-limited scanner. Since Sapphire didn\'t need to wait for responses, each copy could scan at the maximum rate that the processor and network bandwidth could support.

There were also two noteworthy bugs in the pseudo-random number generator which complicated our analysis and limited our ability to estimate the total infection but did not slow the spread of the worm.
Files: youtubeThe Spread of the Sapphire/Slammer Worm
pdfThe Spread of the Sapphire/Slammer Worm(PDF)
Sponsors: None.

Back to NANOG27 agenda.

NANOG27 Abstracts

  • The Spread of the Sapphire/Slammer Worm
    Speakers:
    David MooreCAIDA & UCSD CSE; .
    Vern PaxsonICIR & LBNL; .
    Stefan SavageUCSD CSE; .
    Colleen ShannonCAIDA; .
    Stuart StanifordSilicon Defense; .
    Nicholas WeaverSilicon Defense & UC Berkeley EECS; .
  • The Spread of the Sapphire/Slammer Worm
    Speakers:
    David MooreCAIDA & UCSD CSE; .
    Vern PaxsonICIR & LBNL; .
    Stefan SavageUCSD CSE; .
    Colleen ShannonCAIDA; .
    Stuart StanifordSilicon Defense; .
    Nicholas WeaverSilicon Defense & UC Berkeley EECS; .
  • The Spread of the Sapphire/Slammer Worm
    Speakers:
    David MooreCAIDA & UCSD CSE; .
    Vern PaxsonICIR & LBNL; .
    Stefan SavageUCSD CSE; .
    Colleen ShannonCAIDA; .
    Stuart StanifordSilicon Defense; .
    Nicholas WeaverSilicon Defense & UC Berkeley EECS; .
  • The Spread of the Sapphire/Slammer Worm
    Speakers:
    David MooreCAIDA & UCSD CSE; .
    Vern PaxsonICIR & LBNL; .
    Stefan SavageUCSD CSE; .
    Colleen ShannonCAIDA; .
    Stuart StanifordSilicon Defense; .
    Nicholas WeaverSilicon Defense & UC Berkeley EECS; .
  • The Spread of the Sapphire/Slammer Worm
    Speakers:
    David MooreCAIDA & UCSD CSE; .
    Vern PaxsonICIR & LBNL; .
    Stefan SavageUCSD CSE; .
    Colleen ShannonCAIDA; .
    Stuart StanifordSilicon Defense; .
    Nicholas WeaverSilicon Defense & UC Berkeley EECS; .
  • The Spread of the Sapphire/Slammer Worm
    Speakers:
    David MooreCAIDA & UCSD CSE; .
    Vern PaxsonICIR & LBNL; .
    Stefan SavageUCSD CSE; .
    Colleen ShannonCAIDA; .
    Stuart StanifordSilicon Defense; .
    Nicholas WeaverSilicon Defense & UC Berkeley EECS; .

 

^ Back to Top