Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

[jmalcolm () uraeus com]

Stuart Staniford writes:
> I wasn't advocating a solution, just observing the way things would 
> have to be for worms to be purely a "buy a bigger box" problem (as I 
> think Sean was suggesting if I didn't misunderstand him).

Ah.

> It would generally seem that ISPs would provide more downstream 
> capacity than upstream, since this saves money and normally not all the 
> downstream customers will use all their bandwidth at the same time.  

Right; statistical multiplexing.

> But a big worm could well break that last assumption.

Yes, as could a number of events, but the response to a worm would
probably be different from the latest streaming video event, or
whatever.

> So it would seem that worms are, at a minimum, not a simple or 
> unproblematic capacity management problem.

Well, it would seem reasonable for an ISP to minimize a worm's effect
on its non-worm customer traffic, and that might mean increasing
capacity in some places, but I don't think the goal would be to move
more worm traffic, but rather to reduce impact to other
traffic. Presumably such activity would be combined with other
anti-worm efforts.