[clug] shimmer

[Michael Still]

Michael Still wrote:
> Tim Jones wrote:
>> 2008/7/11 Michael Still <mikal at stillhq.com>:
>>> There is some really interesting research on exactly how common this
>>> sort of thing is, mainly using backscatter analysis from large blocks of
>>> otherwise unused IPs. Its worth a read if you're interested in such things.
>> That does sound interesting - do you have any links to hand please?
> 
> I do, but I'll need to dig them out... If I forget, just poke me in the
> corridor, as I will be back at my desk at DCS on Monday.

A good paper on the topic is:

@article{1132027,
  author =       {David Moore and Colleen Shannon and Douglas J. Brown
                  and Geoffrey M. Voelker and Stefan Savage},
  title =        {Inferring {I}nternet denial-of-service activity},
  journal =      {ACM Trans. Comput. Syst.},
  volume =       {24},
  number =       {2},
  year =         {2006},
  issn =         {0734-2071},
  pages =        {115--139},
  doi =          {http://doi.acm.org/10.1145/1132026.1132027},
  publisher =    {ACM Press},
  address =      {New York, NY, USA},
}

Although there are others as well.

Cheers,
Mikal