[55363] in North American Network Operators' Group
Re: Level3 routing issues?
daemon@ATHENA.MIT.EDU (David G. Andersen)
Mon Jan 27 23:07:42 2003
Date: Mon, 27 Jan 2003 23:07:14 -0500
From: "David G. Andersen" <dga@lcs.mit.edu>
To: Randy Bush <randy@psg.com>
Cc: cowie@renesys.com, nanog@merit.edu
Mail-Followup-To: "David G. Andersen" <dga@lcs.mit.edu>,
Randy Bush <randy@psg.com>, cowie@renesys.com, nanog@merit.edu
In-Reply-To: <E18dLHh-00018U-00@roam.psg.com>
Errors-To: owner-nanog-outgoing@merit.edu
On Mon, Jan 27, 2003 at 06:15:33PM -0800, Randy Bush mooed:
>
> > Wow, for a minute I thought I was looking at one of our old
> > plots, except for the fact that the x-axis says January 2003
> > and not September 2001 :) :)
>
> seeing that the etiology and effects of the two events were quite
> different, perhaps eyeglasses which make them look the same are
> not as useful as we might wish?
Actually, an eyeballing of the MIT data would suggest that the SQL
worm hit harder and faster than NIMDA, and resulted in a more
drastic effect on routing tables. I've updated the page I mentioned
before:
http://nms.lcs.mit.edu/~dga/sqlworm.html
to also contain the graph of MIT updates during the NIMDA worm.
I should note that our route monitor moved closer to MIT's border
router between these updates - it's now colocated in the same datacenter,
and before it was across the street, which made it a bit more susceptable
to link resets during the NIMDA worm attack. LCS is more prone to
dropping off the network than is the entire MIT campus. Therefore, the
NIMDA graph probably has a few more session resets (the spikes up to
100,000 routes updated) than it should.
-Dave
--
work: dga@lcs.mit.edu me: dga@pobox.com
MIT Laboratory for Computer Science http://www.angio.net/
I do not accept unsolicited commercial email. Do not spam me.
