Tribe Flood Network (TFN), TFN2K
written by a known hacker named Mixter
ICMP flooding, SYN flooding, UDP flooding
Unix, Solaris, Windows NT
Opened shell in every agent for running handler program
Trinoo
UDP flooding
Trinoo is famous for allowing attackers to leave a message in a folder called cry_baby
The file is self replicating and is modified on a regular basis as long as port 80 is active
Stacheldraht
Combines features of TFN and Trinoo
Adds encrypted communication