[19442] in North American Network Operators' Group
Re: NY times appears to have had a rough morning..
daemon@ATHENA.MIT.EDU (Phil Howard)
Sun Sep 13 12:17:35 1998
From: Phil Howard <phil@charon.ipal.net>
To: rirving@onecall.net
Date: Sun, 13 Sep 1998 10:50:44 -0500 (CDT)
Cc: nanog@merit.edu
In-Reply-To: <35FBBDC3.B70F846C@onecall.net> from "Richard Irving" at Sep 13, 98 07:42:43 am
Richard Irving wrote:
> Hrmm.. This sunday am I logged into www.nytimes.com,
> and got an unusual front page. Someone may want to take
> a look......
Looks like the classical underconfigured/overloaded server to me. They were
probably running with not much spare capacity before, or didn't configure the
correct number of listening processes (or enough RAM to handle them).
Possibly a SYN attack. But on this date, more likely a demand "attack".
This is not unusual when you consider the total capacity is ultimately
determined by the suits.
FYI, I had no trouble pulling it from icreport.loc.gov. I got it in the
evening, which would have been the 2nd demand curve for the day. So server
capacity there was enough to deliver it in that probably broader hump. But
maybe the masses, who normally go checking news sites and wouldn't recognize
a .gov site as even being an Internet thing, were clobbering places like
www.nytimes.com. Even www.cnn.com seemed kinda slow to me.
--
Phil Howard | stop7it2@anyplace.edu die7spam@spammer0.com stop0ads@spammer5.org
phil | a2b8c2d0@s1p8a2m2.edu stop9it3@anyplace.com stop8303@spam4mer.org
at | no45ads1@lame3ads.org eat2this@dumbads5.net stop6629@anywhere.net
ipal | end1ads8@s2p4a6m3.edu ads8suck@anyplace.com stop0549@no9place.com
dot | blow3me9@anyplace.com no29ads0@anywhere.net stop1694@no71ads2.net
net | stop4688@s5p9a1m1.net end0it82@no2where.com end1it08@no0place.edu
