> here's a plot showing the impact on BGP routing tables from seven ISPs
> (plotted using route-views data):
> error
And as an interesting counterpoint to this, this graph shows
the number of BGP routing updates received at MIT before, during,
and after the worm (3 day window). Tim's plots showed that the
number of actual routes at the routers he watched was down
significantly - these plots show that the actual BGP traffic
was up quite a bit. Probably the withdrawals that were taking
routes away from routeviews...
http://nms.lcs.mit.edu/~dga/sqlworm.html
-Dave
Wow, for a minute I thought I was looking at one of our old plots,
except for the fact that the x-axis says January 2003 and not
September 2001 
Your plot is consistent with what we saw on Saturday as well. Looks
much like a "little Nimda."
Blast from the past:
http://www.renesys.com/projects/bgp_instability
--jim
Wow, for a minute I thought I was looking at one of our old
plots, except for the fact that the x-axis says January 2003
and not September 2001
seeing that the etiology and effects of the two events were quite
different, perhaps eyeglasses which make them look the same are
not as useful as we might wish?
randy
On Mon, Jan 27, 2003 at 06:15:33PM -0800, Randy Bush mooed:
> Wow, for a minute I thought I was looking at one of our old
> plots, except for the fact that the x-axis says January 2003
> and not September 2001
seeing that the etiology and effects of the two events were quite
different, perhaps eyeglasses which make them look the same are
not as useful as we might wish?
Actually, an eyeballing of the MIT data would suggest that the SQL
worm hit harder and faster than NIMDA, and resulted in a more
drastic effect on routing tables. I've updated the page I mentioned
before:
http://nms.lcs.mit.edu/~dga/sqlworm.html
to also contain the graph of MIT updates during the NIMDA worm.
I should note that our route monitor moved closer to MIT's border
router between these updates - it's now colocated in the same datacenter,
and before it was across the street, which made it a bit more susceptable
to link resets during the NIMDA worm attack. LCS is more prone to
dropping off the network than is the entire MIT campus. Therefore, the
NIMDA graph probably has a few more session resets (the spikes up to
100,000 routes updated) than it should.
-Dave