Re: Level3 routing issues?

["David G. Andersen" <dga () lcs mit edu>]

On Mon, Jan 27, 2003 at 06:15:33PM -0800, Randy Bush mooed:
> > Wow, for a minute I thought I was looking at one of our old
> > plots, except for the fact that the x-axis says January 2003
> > and not September 2001 :) :)
>
> seeing that the etiology and effects of the two events were quite
> different, perhaps eyeglasses which make them look the same are
> not as useful as we might wish?

  Actually, an eyeballing of the MIT data would suggest that the SQL
worm hit harder and faster than NIMDA, and resulted in a more
drastic effect on routing tables.  I've updated the page I mentioned
before:

  http://nms.lcs.mit.edu/~dga/sqlworm.html

  to also contain the graph of MIT updates during the NIMDA worm.

I should note that our route monitor moved closer to MIT's border
router between these updates - it's now colocated in the same datacenter,
and before it was across the street, which made it a bit more susceptable
to link resets during the NIMDA worm attack.  LCS is more prone to
dropping off the network than is the entire MIT campus.  Therefore, the
NIMDA graph probably has a few more session resets (the spikes up to
100,000 routes updated) than it should.

  -Dave

-- 
work: dga () lcs mit edu                          me:  dga () pobox com
      MIT Laboratory for Computer Science           http://www.angio.net/
      I do not accept unsolicited commercial email.  Do not spam me.