Once the Worm enters the doit routine, it runs a series of procedures designed to search for and connect to other hosts. This is the Worm's first attempt at infecting other host machines.
|
|
Using a random number (seeded by the current time), the Worm then determines whether or not to check for itself. There is a one in seven chance that it will not; otherwise, the Worm checks itself.
|
|
If the Worm does not check for itself, it will go ahead and continue. This one in seven chance was originally added to make the Worm more difficult to kill; ironically, it worked in the sense that this addition is why the Worm spread so quickly. In addition, only the first copy of the Worm on any one machine would check for itself; all subsequent copies skip the test entirely.
|
|
|
There is also a procedure that was supposed to send one byte to the address 128.32.137.13 (ernie.berkeley.edu), port 11357; this did not work, though, since the program used the TCP command sendto, instead of a UDP datagram. Since the program never initiated a connection with the afore-mentioned port, the TCP command failed with a "socket not connected" error. This random (one in fifteen) byte appeared to be for monitoring the overall progress of the Worm on the net.
|