Stuart Staniford writes:
I wasn't advocating a solution, just observing the way things would have to be for worms to be purely a "buy a bigger box" problem (as I think Sean was suggesting if I didn't misunderstand him).
Ah.
It would generally seem that ISPs would provide more downstream capacity than upstream, since this saves money and normally not all the downstream customers will use all their bandwidth at the same time.
Right; statistical multiplexing.
But a big worm could well break that last assumption.
Yes, as could a number of events, but the response to a worm would probably be different from the latest streaming video event, or whatever.
So it would seem that worms are, at a minimum, not a simple or unproblematic capacity management problem.
Well, it would seem reasonable for an ISP to minimize a worm's effect on its non-worm customer traffic, and that might mean increasing capacity in some places, but I don't think the goal would be to move more worm traffic, but rather to reduce impact to other traffic. Presumably such activity would be combined with other anti-worm efforts.