The attack itself is performed in an infinite loop. The IP addresses used for scanning are generated randomly using the rand() function and the GetTickCount() results as a random seed. The only filter rule for an IP address is that it cannot start with 127, 172 or 192. A separate thread is created to communicate with each IP address.