Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-29 Thread Petri Helenius
Sean Donelan wrote: What is the difference between a transit provider and an access provider, specially in the consumer space? Why is a transit provider expected to deliver the bits, but the access provider isn't? Since the bulk of Internet access is actually provided by wholesale providers

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-28 Thread Petri Helenius
Sean Donelan wrote: ISPs don't have (much) control over third-party computers. But they can control their network capacity. Of course, its not a complete solution. If you are a mid-level ISP, you may have a choke point to your customer but are vulnerable from your upstream provider. A better

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-28 Thread Sean Donelan
On Sat, 29 Nov 2003, Petri Helenius wrote: If you are an access provider, specially in the consumer space, you can do many things to help the Greater Internet by keeping your own back yard in good shape. In the transit business, you are expected to deliver the bits regardless of the content

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-28 Thread Daniel Senie
At 06:24 PM 11/28/2003, Sean Donelan wrote: On Sat, 29 Nov 2003, Petri Helenius wrote: If you are an access provider, specially in the consumer space, you can do many things to help the Greater Internet by keeping your own back yard in good shape. In the transit business, you are expected to

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-28 Thread Stephen J. Wilcox
On Fri, 28 Nov 2003, Daniel Senie wrote: At 06:24 PM 11/28/2003, Sean Donelan wrote: On Sat, 29 Nov 2003, Petri Helenius wrote: If you are an access provider, specially in the consumer space, you can do many things to help the Greater Internet by keeping your own back yard in good

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-25 Thread Rob Thomas
Hi, Stuart. ] So you believe that the edges of the net are smaller, bandwidth-wise, ] than the core? This was certainly the case in my previous life at a large hosting provider. We had GigE LANs, used providers with OC192 backbones, but had only OC3 to OC12 links to our providers. Like most

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-25 Thread Sean Donelan
On Tue, 25 Nov 2003, Rob Thomas wrote: Our choke points were always our peering or transit links. This was the case for our (large) enterprise customers as well. Some people refer to it as the hourglass effect, but it has more than one bump. Generally only the smallest bottleneck controls

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-25 Thread Rob Thomas
Hi, Sean. ] lower bandwidthhigher bandwidth Great ASCII chart. :) ] Of course, there are some exceptions like a customer with an OC192 uplink ] or an ISP running a web hosting center on a ISDN link. Another bit to consider is address space. Code Red discovered a lot of folks with

Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-24 Thread Stuart Staniford
[Sorry for responding to old mail, but I'm catching up] On Sunday, November 16, 2003, at 02:12 PM, Sean Donelan wrote: I've often tried to explain that ISPs generally view worms as a capacity planning issue. Worms change the eco-system of the Internet and ISPs have to adapt. But ISPs

Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-24 Thread jmalcolm
Stuart Staniford writes: It would seem for the Internet to reliably resist bandwidth attacks from future worms, it has to be, roughly bigger in the middle than at the edges. If this is the case, then the worm can choke edges at the sites it infects, but the rest of the net can still function.

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-24 Thread Stuart Staniford
On Monday, November 24, 2003, at 04:59 PM, [EMAIL PROTECTED] wrote: So, essentially, you are saying that the edges (customers, presumably) need to be bandwidth-limited to protect the core? I wasn't advocating a solution, just observing the way things would have to be for worms to be purely a

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-24 Thread jmalcolm
Stuart Staniford writes: I wasn't advocating a solution, just observing the way things would have to be for worms to be purely a buy a bigger box problem (as I think Sean was suggesting if I didn't misunderstand him). Ah. It would generally seem that ISPs would provide more downstream

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-24 Thread Sean Donelan
On Mon, 24 Nov 2003, Stuart Staniford wrote: So it would seem that worms are, at a minimum, not a simple or unproblematic capacity management problem. Things are rarely as simple as they appear. Even buying a military grade black box may not solve the worm problem. There are some natural

Re: Worm Bandwidth [was Re: Santa Fe city government computers knocked out by worm]

2003-11-24 Thread Stuart Staniford
On Monday, November 24, 2003, at 08:00 PM, Sean Donelan wrote: There are some natural choke points in the Internet between ISPs and customers. The customer may have a 1000 Mbps GigE LAN and the ISP may have an OC192 backbone, but the link between them is normally much smaller. Slammer,

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Alex Yuriev
No explaination why Sante Fe officials had not patched the city's computers in the three months since Microsoft announced the vulnerability and released the software updates. Nor why Sante Fe didn't have up to date anti-virus programs running on its computers. Nor why they were using such

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Valdis . Kletnieks
On Mon, 17 Nov 2003 06:26:50 EST, Alex Yuriev said: Because for people outside our little industry the software is a tool to get a JOB done, not the job itself. It doesn't take long for the average mechanic to learn that buying cheap wrenches is a bad idea. pgp0.pgp Description: PGP

RE: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Jeffrey Paul
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Mon, 2003-11-17 10:23 To: Alex Yuriev Cc: [EMAIL PROTECTED] Subject: Re: Santa Fe city government computers knocked out by worm On Mon, 17 Nov 2003 06:26:50 EST, Alex

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Sean Donelan writes: The US is still losing relatively major city government computer networks due to the Nachi/Welchia worm. Sante Fe city government's entire computer network was knocked offline on Friday by the Nachi worm. City employees could not access

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Alex Yuriev
On Mon, 17 Nov 2003 06:26:50 EST, Alex Yuriev said: Because for people outside our little industry the software is a tool to get a JOB done, not the job itself. It doesn't take long for the average mechanic to learn that buying cheap wrenches is a bad idea. Do you take your car to

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread kenw
On Mon, 17 Nov 2003 06:26:50 -0500 (EST), you wrote: No explaination why Sante Fe officials had not patched the city's computers in the three months since Microsoft announced the vulnerability and released the software updates. Nor why Sante Fe didn't have up to date anti-virus programs

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Valdis . Kletnieks
On Mon, 17 Nov 2003 15:25:08 GMT, Jeffrey Paul said: Which is probably why they end up buying the expensive, supported one (like everyone else). It's also why they get worms. I said cheap, not inexpensive. There's a difference. :) pgp0.pgp Description: PGP signature

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread todd glassey
- Original Message - From: Jeffrey Paul [EMAIL PROTECTED] To: [EMAIL PROTECTED]; Alex Yuriev [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Monday, November 17, 2003 7:25 AM Subject: RE: Santa Fe city government computers knocked out by worm -Original Message- From: [EMAIL

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Joe Abley
On 17 Nov 2003, at 11:17, todd glassey wrote: H - I would have used a different picture - I would have said that the average Ferrari Owner to realizes that if they don't tune their horse, it dies on them... while they are driving it., So why don't the operators of Microsoft OS

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Scott Francis
On Mon, 17 Nov 2003 06:26:50 EST, Alex Yuriev said: Because for people outside our little industry the software is a tool to get a JOB done, not the job itself. Valdis Kletnieks responded: It doesn't take long for the average mechanic to learn that buying cheap wrenches is a bad

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Alex Yuriev
Valdis Kletnieks responded: It doesn't take long for the average mechanic to learn that buying cheap wrenches is a bad idea. to which Alex replied: Do you take your car to McLaren service center? Why not? They definitely have better tools. To which I say: No, but if the mechanic

Re: Santa Fe city government computers knocked out by worm

2003-11-17 Thread Scott Francis
On Mon, Nov 17, 2003 at 09:40:01AM -0500, [EMAIL PROTECTED] said: Valdis Kletnieks responded: It doesn't take long for the average mechanic to learn that buying cheap wrenches is a bad idea. to which Alex replied: Do you take your car to McLaren service center? Why not? They

Santa Fe city government computers knocked out by worm

2003-11-16 Thread Sean Donelan
The US is still losing relatively major city government computer networks due to the Nachi/Welchia worm. Sante Fe city government's entire computer network was knocked offline on Friday by the Nachi worm. City employees could not access e-mail or work with their computers all day Friday, and

Re: Santa Fe city government computers knocked out by worm

2003-11-16 Thread Dr. Jeffrey Race
On Sun, 16 Nov 2003 06:22:08 -0500 (EST), Sean Donelan wrote: http://kobtv.com/index.cfm?viewer=storyviewerid=6232cat=HOME No explaination why Sante Fe officials had not patched the city's computers in the three months since Microsoft announced the vulnerability and released the software

Re: Santa Fe city government computers knocked out by worm

2003-11-16 Thread Sean Donelan
On Sun, 16 Nov 2003, Jamie Reid wrote: There was a comment (maybe even mine) in a previous thread about accepting a base level of potentially compromised hosts on a network, as the costs of rooting out every last one becomes unwieldly. Networks are large enough that security must be viewed