4 ms·
isn't this because the attack is originating from office work computers? people come to office in the morning, turn on the pc = attack starts. at the end of the
by gondo 10y ago
isn't this because the attack is originating from office work computers? people come to office in the morning, turn on the pc = attack starts. at the end of the day they simply switch off their computer = attach stops.
- jerf 10y agoIf this was the result of many thousands of such machines, you'd see a much more gradual ramp up and shut down because they wouldn't be in such good sync with each other, plus the ceiling wouldn't necessarily be so sharp either. This is especially true once you consider timezones, and the fact that botnets are not generally confined to a single timezone. While this may be a lot of machines, the relative sharpness of the bandwidth graphs suggests a single control source turning things on and off, even though the attack itself may be using an arbitrary number of machines. (Note the fact that it isn't perfectly sharp doesn't mean it isn't a single source... it takes time to command and control thousands of machines over the internet.)