# Law of rare events applyed to malicious packets arrival

I'm studying the malicious incoming traffic of a server. I've noticed that the inter-arrival time between packets follow an exponential distribution. This suggested that the packets arrival follows a Poisson distribution . One plausible explanation for this is based on the law of rare events. Usually the malicious packets scans a large IP scope, so there is a little probability that such packets arrive to the server. Observing that the rate of the packets is not constant in time, is possible to state that the packets have been sent following a random strategy?

-
@markussian If the rate of the packets is not constant, why did you conclude that the inter-arrival time between packets follow an exponential distribution ? –  Sasha Nov 23 '11 at 14:08
Because I've made a graph of the inter arrival time (an histogram) and it is for sure exponential. In fact if I use a log scale on the y axis I can clearly see a line –  markusian Nov 23 '11 at 19:50