Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

[Sean Donelan <sean () donelan com>]

On Tue, 25 Nov 2003, Rob Thomas wrote:
> Our choke points were always our peering or transit links.  This
> was the case for our (large) enterprise customers as well.

Some people refer to it as the hourglass effect, but it has more than one
bump.  Generally only the smallest bottleneck controls the congestion.
But worms and DDOS (but not DOS) violate some of the assumptions.

        lower bandwidth<---->higher bandwidth

                        Local Area Network (LAN)
                Campus Area Network
        Customer to ISP uplink
                ISP POP to Backbone
                                ISP Intra-Backbone
                        ISP to ISP transit/peer (same continent)
                Intercontinental circuits

Of course, there are some exceptions like a customer with an OC192 uplink
or an ISP running a web hosting center on a ISDN link.