On Mon, Jan 27, 2003 at 06:15:33PM -0800, Randy Bush mooed:
Wow, for a minute I thought I was looking at one of our old plots, except for the fact that the x-axis says January 2003 and not September 2001 :) :)
seeing that the etiology and effects of the two events were quite different, perhaps eyeglasses which make them look the same are not as useful as we might wish?
Actually, an eyeballing of the MIT data would suggest that the SQL worm hit harder and faster than NIMDA, and resulted in a more drastic effect on routing tables. I've updated the page I mentioned before: http://nms.lcs.mit.edu/~dga/sqlworm.html to also contain the graph of MIT updates during the NIMDA worm. I should note that our route monitor moved closer to MIT's border router between these updates - it's now colocated in the same datacenter, and before it was across the street, which made it a bit more susceptable to link resets during the NIMDA worm attack. LCS is more prone to dropping off the network than is the entire MIT campus. Therefore, the NIMDA graph probably has a few more session resets (the spikes up to 100,000 routes updated) than it should. -Dave -- work: dga@lcs.mit.edu me: dga@pobox.com MIT Laboratory for Computer Science http://www.angio.net/ I do not accept unsolicited commercial email. Do not spam me.