NAME
====
  Sasser.B
        + WORM_SASSER.U (TrendMicro)
        + W32.Sasser.B.Worm (Symantec)


EXPERIMENTAL TYPE
=================
  Retrieval Behavior - includes retrieval packets only.


EXPERIMENTAL ENVIRONMENT
========================

   131.113.1.1                  131.113.1.2
  +-----------+                +-----+-----+
  | Infected  |                | Targeted  |
  |    PC     |                |    PC     |
  |  (*1)(*2) |                |           |
  +-----+-----+                +-----+-----+
        |                            |
  ------+----------------------------+------
  131.113.1.0/31

  (*1) Windows XP on VMware
  (*2) Default Route = 131.113.1.2


PCAP SUMMARY
============

Total: 6157  START: 1 0.000000
-----------------
445/TCP;: 2064
  1 0.000000 131.113.1.1 131.113.150.166 TCP 1032 > 445 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1460