Fwd: Re: Digital Island sponsors DoS attempt?

Fri Oct 26 16:10:21 UTC 2001

On Fri, 26 Oct 2001, Jonas Luster wrote:

> * Joe Abley sez:
>
> > On Thu, Oct 25, 2001 at 05:37:16PM -0700, Christopher J. Wolff wrote:
> >
> > 441 echo requests in two hours?
> >
> > That doesn't sound like a very big hammer :)
>
> It is also way more than necessary to gather any kind of statistics or
> improve any kind of routing. 441/120 == one every 20 seconds. I cannot
> possibly imagine any circumstances in which this amount of "testing" is
> necessary if the remote end is some site outside the influence of
> Digital Island.

I didn't see anything in this thread to indicate that one IP address was
pinged 441 times.  The network was pinged 441 times.  Furthermore, I
didn't see anything to indicate that the network was pinged from a single
host.  If this was a single measurement repeated 441 times, I'd have a
much different view of it than if it was a set of 441 distinct
measurements in response to multiple user requests.

I've assumed that it was multiple measurements to different hosts in the
destination network from different sites under DI's control.  As long as
the testing is proportionate with the amount of content delivered to the
end user's machine, you don't need to save many TCP retransmits to cause a
net benefit to the network.  (Yes, the destination network, too.  Not just
the transmitting network or the intervening transit networks.)

-Steve