Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

jmalcolm at uraeus.com jmalcolm at uraeus.com
Tue Nov 25 01:39:06 UTC 2003

Stuart Staniford writes:
>I wasn't advocating a solution, just observing the way things would 
>have to be for worms to be purely a "buy a bigger box" problem (as I 
>think Sean was suggesting if I didn't misunderstand him).


>It would generally seem that ISPs would provide more downstream 
>capacity than upstream, since this saves money and normally not all the 
>downstream customers will use all their bandwidth at the same time.  

Right; statistical multiplexing.

>But a big worm could well break that last assumption.

Yes, as could a number of events, but the response to a worm would
probably be different from the latest streaming video event, or

>So it would seem that worms are, at a minimum, not a simple or 
>unproblematic capacity management problem.

Well, it would seem reasonable for an ISP to minimize a worm's effect
on its non-worm customer traffic, and that might mean increasing
capacity in some places, but I don't think the goal would be to move
more worm traffic, but rather to reduce impact to other
traffic. Presumably such activity would be combined with other
anti-worm efforts.

More information about the NANOG mailing list