Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

Tue Nov 25 05:28:10 UTC 2003

On Monday, November 24, 2003, at 08:00 PM, Sean Donelan wrote:

> There are some natural choke points in the Internet between ISPs and
> customers.  The customer may have a 1000 Mbps GigE LAN and the ISP may
> have an OC192 backbone, but the link between them is normally much
> smaller. Slammer, Blaster, etc had very little impact on the major ISP
> backbones, but did severaly congest some of the smaller choke points.  
> Go
> ahead and ask UUNET, Sprint, AT&T, etc. what impact the worms had their
> networks.

So you believe that the edges of the net are smaller, bandwidth-wise, 
than the core?  So the (approximate) picture you would advocate would 
be that Slammer was rate limited at the customer/ISP interface?  (I 
agree this is consistent with the fact that the tier-1s stayed up 
during Slammer).

(I'm not trying to be difficult here - I'm just trying to figure out if 
we actually have any good understanding of this issue - and therefore 
any ability to predict what future worms might do to the Internet).

(Blaster was not bandwidth limited so that's a whole different animal - 
it seems to have been limited by a slow scanning rate, and a poor 
transmission probability).

Stuart.

Stuart Staniford, President                   		Tel: 707-840-9611 x 15
Silicon Defense - Worm Containment - http://www.silicondefense.com/
The Worm/Worm Containment FAQ: http://www.networm.org/faq/