North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

  • From: Stuart Staniford
  • Date: Tue Nov 25 00:25:16 2003 
On Monday, November 24, 2003, at 08:00 PM, Sean Donelan wrote:
There are some natural choke points in the Internet between ISPs and
customers. The customer may have a 1000 Mbps GigE LAN and the ISP may
have an OC192 backbone, but the link between them is normally much
smaller. Slammer, Blaster, etc had very little impact on the major ISP
backbones, but did severaly congest some of the smaller choke points. Go
ahead and ask UUNET, Sprint, AT&T, etc. what impact the worms had their
networks.
So you believe that the edges of the net are smaller, bandwidth-wise, than the core? So the (approximate) picture you would advocate would be that Slammer was rate limited at the customer/ISP interface? (I agree this is consistent with the fact that the tier-1s stayed up during Slammer).

(I'm not trying to be difficult here - I'm just trying to figure out if we actually have any good understanding of this issue - and therefore any ability to predict what future worms might do to the Internet).

(Blaster was not bandwidth limited so that's a whole different animal - it seems to have been limited by a slow scanning rate, and a poor transmission probability).

Stuart.

Stuart Staniford, President Tel: 707-840-9611 x 15
Silicon Defense - Worm Containment - http://www.silicondefense.com/
The Worm/Worm Containment FAQ: http://www.networm.org/faq/