scan engine analysis

works for active worms
useful to predict scans
requires source or lots of data

shows you where to set up defenses

example: original code red, static PRNG seed
always hit the same hosts