I am seeing this as well, but only from a few hosts on a single network. I have contacted their NOC and asked them to "knock" it off - no pun intended... Could be some nimda infected boxes or whatever. Firewalls are stopping it, but it is annoying to wade through the logs. Todd -----Original Message----- From: Al Rowland [mailto:alan_r1@corp.earthlink.net] Sent: Wednesday, January 29, 2003 10:31 AM To: nanog@merit.edu Subject: RE: Dropouts since Saturday 1/25/03 only affecting web traffic? A single point of consumer data. I haven't checked by home router logs since Monday night but I was seeing a pattern of significant incoming port 80 traffic (I'm not running any services) over the last week or so, similar to increased 1433/1434 traffic before Saturday's flurry. Best regards, ______________________________ Al Rowland

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Sean Donelan Sent: Tuesday, January 28, 2003 9:46 PM To: nanog@merit.edu Subject: Dropouts since Saturday 1/25/03 only affecting web traffic?

According to Matrix Systems (http://average.miq.net/Weekly/markR.html) there have been two additional dropouts of global Web reachability on January 26 and January 28. These dropouts have been for few hours or so, but nearly as large as we saw from the SQL worm. However it doesn't seem to affect other network services, as measured by Matrix. Just the measured web servers. The most recent was tonight from 3-5pm and again from 5-7pm EST (http://average.miq.net/)

Any ideas what is causing them? Measurement artifact? Are you seeing something strange on your networks about that time?