[65384] in North American Network Operators' Group
Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]
daemon@ATHENA.MIT.EDU (Stuart Staniford)
Tue Nov 25 00:23:49 2003
Date: Mon, 24 Nov 2003 21:28:10 -0800
Cc: nanog@merit.edu
To: Sean Donelan <sean@donelan.com>
From: Stuart Staniford <stuart@silicondefense.com>
In-Reply-To: <Pine.GSO.4.44.0311242229080.5660-100000@clifden.donelan.com>
Errors-To: owner-nanog-outgoing@merit.edu
On Monday, November 24, 2003, at 08:00 PM, Sean Donelan wrote:
> There are some natural choke points in the Internet between ISPs and
> customers. The customer may have a 1000 Mbps GigE LAN and the ISP may
> have an OC192 backbone, but the link between them is normally much
> smaller. Slammer, Blaster, etc had very little impact on the major ISP
> backbones, but did severaly congest some of the smaller choke points.
> Go
> ahead and ask UUNET, Sprint, AT&T, etc. what impact the worms had their
> networks.
So you believe that the edges of the net are smaller, bandwidth-wise,
than the core? So the (approximate) picture you would advocate would
be that Slammer was rate limited at the customer/ISP interface? (I
agree this is consistent with the fact that the tier-1s stayed up
during Slammer).
(I'm not trying to be difficult here - I'm just trying to figure out if
we actually have any good understanding of this issue - and therefore
any ability to predict what future worms might do to the Internet).
(Blaster was not bandwidth limited so that's a whole different animal -
it seems to have been limited by a slow scanning rate, and a poor
transmission probability).
Stuart.
Stuart Staniford, President Tel: 707-840-9611 x 15
Silicon Defense - Worm Containment - http://www.silicondefense.com/
The Worm/Worm Containment FAQ: http://www.networm.org/faq/
