[65382] in North American Network Operators' Group
Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]
daemon@ATHENA.MIT.EDU (jmalcolm@uraeus.com)
Mon Nov 24 20:39:43 2003
Date: Tue, 25 Nov 2003 01:39:06 +0000
From: jmalcolm@uraeus.com
To: nanog@merit.edu
In-Reply-To: <C50A7F4A-1EE6-11D8-900E-0003930F3816@silicondefense.com>
Errors-To: owner-nanog-outgoing@merit.edu
Stuart Staniford writes:
>I wasn't advocating a solution, just observing the way things would
>have to be for worms to be purely a "buy a bigger box" problem (as I
>think Sean was suggesting if I didn't misunderstand him).
Ah.
>It would generally seem that ISPs would provide more downstream
>capacity than upstream, since this saves money and normally not all the
>downstream customers will use all their bandwidth at the same time.
Right; statistical multiplexing.
>But a big worm could well break that last assumption.
Yes, as could a number of events, but the response to a worm would
probably be different from the latest streaming video event, or
whatever.
>So it would seem that worms are, at a minimum, not a simple or
>unproblematic capacity management problem.
Well, it would seem reasonable for an ISP to minimize a worm's effect
on its non-worm customer traffic, and that might mean increasing
capacity in some places, but I don't think the goal would be to move
more worm traffic, but rather to reduce impact to other
traffic. Presumably such activity would be combined with other
anti-worm efforts.
