Slashdot Mirror

You can always get the daily traffic report here:
http://www.internettrafficreport.com/main.htm

From the packet loss graphs you can see when the outage occured. Yes, everything looks back to normal.

....or is it related?

http://www.internettrafficreport.com/asia.htm is another place to check internet traffic - it's a different metric, but it's still useful. Taiwan and India seem to be the only places doing okay.

The history showing a great disturbance in the force still remain at Internet Traffic Report though.

Ah, so that explains it. At least sort of. I was trying to go to http://www.internettrafficreport.com/ to find out what's up, but it's currently unreachable for me :P

Forget one quote and my post is all screwed up.

I can't reach the ISC:

http://www.internettrafficreport.com/

I agree!

This is a good visual to your point:
http://www.internettrafficreport.com/

Apparently there is a MS05-039 worm in the wild and running now.

*nix users - prepare for the net to slow down.

I had problems with monster (~250ms) latency to the UK, and they pretty much told me that you cant get broadband speed internationally.

That would be because you can't get low pings internationally, it's just not possible with a routed protocol, especially when both sides are not directly on the backbone.

Just take a look at the Internet Traffic Report website, the response time from backbone to backbone is well over 150ms during the day. Add in 30-50ms extra routing on both ends to make your way off the backbones, and you've got ~250ms delay easy, and no less than 150ms in off hours.

In the future will we have net traffic reports

hah, too late.

http://www.internettrafficreport.com/

Looking at that old goofy "Internet Traffic Report" (remember? - from back in the 1990s?) web site, I noticed something that seems significant.

http://www.internettrafficreport.com/7day.htm

There seems to have been a tremendous effect on overall web traffic recently. The 'recovery' period seems incredibly rapid however.

Anyone know how to gauge whether this had any real effect on total spam sent on the (whole) internet? Also, anyone know difinitively what the start/stop times of the "attack" were?

I know the spamhauses themselves were not targetted. Does this merely reflect a couple hundred thousand people smacking the root nameservers with obscure domain lookups? Or was the screensaver using explicit IP addresses?

http://www.internettrafficreport.com/main.htm Shows a little hiccup, or something? What's that blip?

Look at the traffice Report. That could explain your troubles for overseas access...

http://www.internettrafficreport.com/main.htm

My 10(base2)

At about 12:15pm on the US east coast, it should be "tomorrow" soon in the Eastern continents. I'll keep a watch on the stats and flip the switch if necessary :P

I have followed various projects related to mapping cyberspace through the years and have always found An Atlas of Cycerspaces to be fascinating.

Mapping by Lumeta is one such methodology and I even have a poster of theirs printed by Peacock Maps (server down just now) in my office.

I have noticed that these mappings take a long time to complete and being able to map in a short time frame could be beneficial in much the same way that Internet Traffic Report can be to visualize traffic patterns or disruptions.

Taco

Well, according to internetrafficreport, everything is fine. However, Europe has been relocated to Africa.

Checking the Internet Traffic Report site it appears as if Australia and Asia are both crawling. Don't know if this is entirely due to the Welchia worm, but blocking incoming ICMP packets on external interfaces is something I employ as a rule.

Looks like a few people were knocked off line. Look at the Internet Traffic Report site. I wonder how else the net was effected, and if there are any other sites that would reflect this.

Of some interest, the internet in North America seems not to have been affected much.

While on the subject of links, are there any sites we can visit that will show the worm spreading? Like, how network traffic is getting slower and slower in various regions, routers are becoming unresponsive, that sort of thing. I found something showing that Asia is a little slow, but I would guess there are better sites out there somewhere.

Absolutely zilch so far. I'm sure other major worms have shown up as a big spike. Move away folks, there's nothing to see.

Anybody know good Internet traffic type sites where you can watch this unfold? I found one showing that Asia seems to be experiencing some troubles, but I'm not sure how accurate or good the info is.

During all these events, a large Response time and Increased Packet loss is observed, as expected.

Observe that the Average Response time hit a peak simultaneously across all continents between 11:30am and 2:30am MST as noted earlier, which coincides with reports of the W32.Sobig.E@mm worm. It has since deteriorated, possibly indicating, either that the Worm has some throttling mechanism, which some worms use to prevent congestion from affecting their own propogation rate.

Either that, or we haven't seen the peak yet.

During all these events, a large Response time and Increased Packet loss is observed, as expected.

Observe that the Average Response time hit a peak simultaneously across all continents between 11:30am and 2:30am MST as noted earlier, which coincides with reports of the W32.Sobig.E@mm worm. It has since deteriorated, possibly indicating, either that the Worm has some throttling mechanism, which some worms use to prevent congestion from affecting their own propogation rate.

Either that, or we haven't seen the peak yet.

During all these events, a large Response time and Increased Packet loss is observed, as expected.

Observe that the Average Response time hit a peak simultaneously across all continents between 11:30am and 2:30am MST as noted earlier, which coincides with reports of the W32.Sobig.E@mm worm. It has since deteriorated, possibly indicating, either that the Worm has some throttling mechanism, which some worms use to prevent congestion from affecting their own propogation rate.

Either that, or we haven't seen the peak yet.

I have been trying to do my own retrospective predection :) based on the data available at Internet Traffic Report

As far as I can make out, all the US routers are doing fine (green). The response time seems to have gone up a tad at 2am MST, but other than that I don't see anything unusual.

When I look at Asia, 5 out of the 21 routers are down (red) and the packet loss is up 2%. Does that mean, that the worm has hit Asia hard? I know this worm should clog up mainly mail servers, but I wonder how feasible it is to predict worm arrival/origin/etc based on this easily available information, assuming ofcourse that it's available realtime.

I have been trying to do my own retrospective predection :) based on the data available at Internet Traffic Report

As far as I can make out, all the US routers are doing fine (green). The response time seems to have gone up a tad at 2am MST, but other than that I don't see anything unusual.

When I look at Asia, 5 out of the 21 routers are down (red) and the packet loss is up 2%. Does that mean, that the worm has hit Asia hard? I know this worm should clog up mainly mail servers, but I wonder how feasible it is to predict worm arrival/origin/etc based on this easily available information, assuming ofcourse that it's available realtime.

I have been trying to do my own retrospective predection :) based on the data available at Internet Traffic Report

As far as I can make out, all the US routers are doing fine (green). The response time seems to have gone up a tad at 2am MST, but other than that I don't see anything unusual.

When I look at Asia, 5 out of the 21 routers are down (red) and the packet loss is up 2%. Does that mean, that the worm has hit Asia hard? I know this worm should clog up mainly mail servers, but I wonder how feasible it is to predict worm arrival/origin/etc based on this easily available information, assuming ofcourse that it's available realtime.

According to Internet Traffice Report [internettr...report.com], overall global traffic is down the last three days

You're mistaken. The "global traffic index" on ITR is a measure of response time, not "overall global traffic" like you claim. The number is lower meaning that the global index is down, i.e. things are going more slowly. If you would have bothered to look at the 2 graphs below the graph you reference you would have noticed the global response time has gone up and packet loss almost doubled when the war began.

Try reading the relevant portion of the FAQ

According to Internet Traffice Report, overall global traffic is down the last three days. Not that it shows the whole picture. I'm sure that the shape of that traffic in the last few days has changed dramatically.

If you don't know about it, this is a good time to know.

Packet loss reached 14% at 2:20, and the global traffic index dropped to just below 73%. However, according to the many graphs on the site, things have pretty much recovered.

Look at this, especially that huge packet loss spike at 11/24...

Seems suspicious, although that site hasn't put up any news about it like they did with the major DNS attack a copule of weeks ago.

This would indicate why many of you may not have noticed any slowdowns in response time.

Most revealing is the 7-day plot of network activity and response times. While there are normal variations thoughout the days, there's a definite spike there at the end.

Here is an autoupdated ping time for major US routers. Also includes a trendline graph of relative network strength. The Internet Traffic Report for North America.

And Novell's MyRealBox server is down because of this (I'm guessing).

Internet Traffic Report has a page where you can follow traffic. Sure is a lot of red today.

Digex mnages hosting for a key service my employer provides, and they're in and out intermittently.

Our VPN link keeps going up, down, down in one direction, around in circles, several times per minute.

http://www.internettrafficreport.com has some fun results for you, too.

I've been seeing odd intermittent packet loss across sprint and worldcom all day. I started checking itr and saw 25% average packetloss across north america, with about 20% of the routers they monitor passing 0% traffic and turned on CNN... Figured something had to be happening...

a whole lot of red over at the InternetTrafficReport any other good informative sites?

You mean like this?

http://www.internettrafficreport.com/ Strange.

look for yourself

For years internet architects have built a house of cards that is not nearly as robust as it's outer appearance. In fact, there are some aspects that point to a fragile infrastructure just waiting for the final earthquake. The ATM backbone that Tom's previous company helped produce, is largely responsible for creating the packet lost instabilities in the network over the last 5 years. Under Vint Cerf's leadership at MCI/WorldCom/UUNet (Will WorldCom's Woes Engulf UUNet?) switched ATM networks created several years of heavy packetloss at key peering points, that can only cascade into total collapse if UUNet goes dark. This fragility might be the only thing that actually saves WorldCom/UUNet - the fear of what can happen without it.

With UUNet dark, the remaining network lacks the switching capacity to handle all of today's traffic (it barely can handle today's traffic without packet loss monitored here), much less short term growth as the world economy recovers from the dire recession. The resulting high packet loss would take us back 5 years where many DNS lookups timed out and simply failed due to high packet loss, and the network loading is dominated by 100% to 300% retries cascading into congestive failure (RFC896 Congestion Control in IP/TCP Internetworks. J. Nagle. January 1984).

There have been many people explore this issue, some very excellent papers (Quality of Service in the Internet: Fact, Fiction, or Compromise? by Paul Ferguson and Geoff Huston) - but largely missed are very basic architectural issues like NTP time syncronization network wide for packet loss retransmission that CREATES well synchronized additional packet loss. This happens because the retranmissions are all timed to arrive at the same time in overloaded switches just to be dropped again due to servers having their scheduling clocks syncronized at a very low rate of 50/60/100/1K Hertz.

A study I did in 1997 of peering point packet loss showed that 90% of packet loss observed correlated to retransmit clock boundries. Changes in traffic flow from primarily mail and ftp in the early 90's, to web traffic where browsers launch 4-20 concurrent small file lookups changed the nature and ability for Slow Start to be effective in throttling loads causing packet loss (web browser designers flood requests to mask packet loss timeouts) and the short files which are often only a couple packets in length do not throttle with TCP window size controls.

Nothing in the next generation design of the internet (IPv6, VoIP, Streaming UDP MP3's, FPS games which flood packets, or any other new protocol) addresses these critical failings ... in fact there is a huge head in the sand approach to just continue providing excess bandwidth and applications to saturate it even more quickly.

Tom's suggestions largely miss the boat, for all the wrong reasons - but the end conclusion is correct - the biggest problems tomarrow are not going to be solved by the solutions being offered.

Can't reach Canada.
Internet Traffic Report pronounces the internet "dead"!

Check the Internet Traffic Report

FYI: Internet Traffic Report Show the router "defra229-tc.ebone.ne" as down.
Stay tunned for more red lights...
L.

Followup, the routers in Portugal and Poland are back up, only one down is the EBone one in Frankfurt.

25 Minutes past the 17:00 CET deadline and the Internet Traffic Report - Europe doesn't show a dip of network router reachability. Oonly problems are the listed Ebone router in Frankfurt that went down 3 days ago, and some Global-One routers in Portugal that went down a few hours ago, and one TPnet router in Poland, which dropped traffic moments ago.

25 Minutes past the 17:00 CET deadline and the Internet Traffic Report - Europe doesn't show a dip of network router reachability. Oonly problems are the listed Ebone router in Frankfurt that went down 3 days ago, and some Global-One routers in Portugal that went down a few hours ago, and one TPnet router in Poland, which dropped traffic moments ago.

25 Minutes past the 17:00 CET deadline and the Internet Traffic Report - Europe doesn't show a dip of network router reachability. Oonly problems are the listed Ebone router in Frankfurt that went down 3 days ago, and some Global-One routers in Portugal that went down a few hours ago, and one TPnet router in Poland, which dropped traffic moments ago.

25 Minutes past the 17:00 CET deadline and the Internet Traffic Report - Europe doesn't show a dip of network router reachability. Oonly problems are the listed Ebone router in Frankfurt that went down 3 days ago, and some Global-One routers in Portugal that went down a few hours ago, and one TPnet router in Poland, which dropped traffic moments ago.