Which had more impact on the the net?
1. Destruction in New York City Sept 11 and following days
2. Nimda virus/worm on Sept Sept 18 and following days
3. Multiple fiber cuts on Sept 26
Its not a straight forward question. They each impacted the
net in different ways. The fiber cuts had the hardest, most
immediate impact. It showed up as a very sharp spike in terms
of packet loss and latency. But their impact was short lived.
It mostly affects the backbones, and leads to lots of route
flapping. The number of routes seems to go up.
The Nimda, Code Red I/II, and other worms had a more difuse
impact. Their effects show up with a ramping period, peaking
after a few hours and then slowly declining over several days.
Their impact is extremely long lived. It mostly affects the
edges of the network.
The destruction in NYC had an immediate impact on news web sites,
but not an immediate impact on the net. Instead the failures
show up as a several dips and recoveries over several hours and
days after the planes impact and collapse of the towers. But
outside of news sites, and beyond a 100 or so miles of NYC, the
net is relatively unaffected, with a few notable exceptions of
overseas networks routing through NYC facilities. Based on previous
central office failures, it will take about 6 weeks for the
repairs stop showing up on measurement sites.
According to certain NANOG members, Nick Catalano. 
I would have to vote for Nimda. Clearly it has raged hell on a lot of
equipment that wasn't prepared for those kinds of loads. I think the
biggest impact was felt at the residential provider level (cable/DSL
providers).
I did speak with an intelligent engineer from AT&T Broadband (yes they
do exist) today about the routing problem I was seeing. He mentioned
that they are developing a system to de-provision customers whose
home/business computers are wrecking havoc. To date the problem hasn't
been taking the customer off line, but rather a CSR in a distant city
reactivating accounts withing hours after they had been deactivated.
This new system will deactivate the account and only allow specific
action (patch downloads) once the customer calls to find out why their
account was disengaged. Further action would be required to get the
customer back into service. I think this is a very good step forward
for a Cable provider, especially one as large as AT&T BB.
-Jim P.
Date: Thu, 27 Sep 2001 01:47:21 -0400 (EDT)
From: Sean Donelan <sean@donelan.com>
Which had more impact on the the net?
An interesting question... I'm not sure that they're directly
comparable. As Patrick pointed out, they have different side
effects.
1. Destruction in New York City Sept 11 and following days
2. Nimda virus/worm on Sept Sept 18 and following days
3. Multiple fiber cuts on Sept 26
1. Damage focused at selected vertices
2. Congestion across the entire mesh
3. Damage along selected edges.
Viewing the Internet as one large graph, all three affected
different portions. When damage occurs, spokes disappear, and
nearby vertices/edges become more congested.
This is probably one very good reason that big providers demand
peering in >= { 3 | 4 | however many } locations in different
regions across the country: Performance might plummet in the
event of damage, but there are alternate routes.[1]
Multiple fiber cuts _did_ elicit a curious thought, though:
Terrorists get ahold of backhoes and fiber maps. Eek.
[1] This assumes that, when an edge or vertex disappears, the
providers peering will route traffic "down the road". This is
an administrative issue, but at least the infrastructure for a
survivable network is in place.
Eddy