[nsp-sec] Conficker Timecheck Daily Reports Data

[Tim Wilde]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Smith, Donald wrote:
> Tim, I noticed that ips are NOT uniqued.
> It appears the combination of ip and src port are unique.
> I assume that was done on purpose. Do we know if each ip only reports to one sensor or do the individual ports represent different sensors or can we not imply anything about which sensor reported that ip/port?

Don,

That's correct, as with our other Conficker data we are reporting the
entry multiple times if the IP was seen multiple times within the day in
question.  Multiple entries for an IP may or may not have been from the
same sensor.

Regards,
Tim

- --
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-630-230-5433 | http://www.team-cymru.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFJ55qBluRbRini9tgRAnx2AJ9Was6h5JjVHePoOJTtQv3jQGr/rACeKCvZ
32Sd1imznXRodxRXg8FL/+U=
=spWm
-----END PGP SIGNATURE-----