Re: New worm / port 1434?'

["David G. Andersen" <dga () lcs mit edu>]

On Sat, Jan 25, 2003 at 10:49:01AM -0500, Eric Gauthier mooed:
> Ok,
>
> I'm not sure if this helps at all.  Our campus has two primary connections - 
> the main Internet and something called Internet2.  Internet2 has a routing
> table of order 10,000 routes and includes most top-tier research instituations
> in the US (and a few other places).  By 1am this morning (Eastern US time),
> all of our Internet links saturated outbound but we didn't appear to see any 
> noticable increase in our Internet2 bandwidth.  I'm throwing this out there 
> because it may indicate that the destinations for the traffic - though large - 
> aren't completely random.
>
> Has anyone else seen this?

  It's actually fairly rational.  If you look at the size of the
I2 routing table in terms of how much of the IP space it covers,
it's a fair bit smaller than the full Internet routing table.  And
most institutions have _more_ I2 bandwidth than commodity internet
connectivity.  If the probing's roughly random, you'd expect the
I2 connection to fare better.
 
  MIT's I2 connectivity was better off than its commercial Internet
connection as well.  Our private peering link to AT&T/mediaone was
actually in great shape (DS3, very small address space).

  -Dave

-- 
work: dga () lcs mit edu                          me:  dga () pobox com
      MIT Laboratory for Computer Science           http://www.angio.net/
      I do not accept unsolicited commercial email.  Do not spam me.