Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

Tue Nov 25 14:20:56 UTC 2003

On Tue, 25 Nov 2003, Rob Thomas wrote:
> Our choke points were always our peering or transit links.  This
> was the case for our (large) enterprise customers as well.

Some people refer to it as the hourglass effect, but it has more than one
bump.  Generally only the smallest bottleneck controls the congestion.
But worms and DDOS (but not DOS) violate some of the assumptions.

	lower bandwidth<---->higher bandwidth

			Local Area Network (LAN)
		Campus Area Network
	Customer to ISP uplink
		ISP POP to Backbone
				ISP Intra-Backbone
			ISP to ISP transit/peer (same continent)
		Intercontinental circuits

Of course, there are some exceptions like a customer with an OC192 uplink
or an ISP running a web hosting center on a ISDN link.