Methodology, cont.

Worm propagation
CodeRed (v2)
uniform random distribution of target IPs
Nimda
island hopping
50%: address in same /16
25%: address in same /8
25%: completely random