Slashdot Mirror
The Tiger Effect and Internet DDoS
An anonymous reader writes "Many US and Canadian ISPs thought they were under a massive denial of service attack yesterday — traffic spiked by hundreds of gigabits across North America. Turns out that the traffic was due to live streaming of the U.S. Open and Tiger Woods nail-biting victory."
Tigerdotted
I Got wooded?
ok /.ers you can do better. I need to update my ids logs to take this into consideration ;)
CS: It is all sink or swim...oh and did I mention there are sharks in that water?
Who knew that there was a professional nail-biter's competition, let alone that Tiger Woods won it?
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
You mean it wasn't due to Firefox downloads? Guess it's not yet as mainstream as I'd like it to be. :)
Developers: We can use your help.
All that an you couldn't even bother to do a "first post" quote.
You mad
I thought it was due to Euro2008 coverage on Espn360.com
Evolution is a state-sponsored, state-protected religion.
Haven't most users updated to Leopard by now?
Jennicam caused massive overloading the first time she had realtime sex. Likely there were other occasions before that too.
Engineering is the art of compromise.
I remember working at a streaming media startup and a Tiger nail bitter was our first live event. 8 Years ago that was 24gb a sec and the average bit rate was 368kbs if I remember correctly. There is a lot more bandwidth now than then. The fun part was running the logs and associating the AS and often the big company associated with it, there seemed to be a lot of people with comfy offices a lot of bandwidth and a love of golf back then.
No sir I dont like it.
7-9mbps down, 512up, $30 :D Cox, Oklahoma City (although the city itself is terrible)
Evolution is a state-sponsored, state-protected religion.
I find it hard to believe that there's anything that can possibly be nail-biting about watching golf.
If these ISPs were overloaded to the point of thinking they may be being DDoS'ed over one event online, they are they wholly unprepared for any sort of attack that may actually be focused at them? Imagine the carnage a real attack would wreak on the ISPs! Is there anyone out there that knows the likelihood of ISPs going down if they came under a real attack? If a few botnets targeted these ISPs, could they be brought down completely? Imagine one of these ISPs really stepping up the game for a tiered internet service model, putting themselves out there as a lightening rod for angry nerds. Could a coordinated effort break the back of an ISPs ability to provide any service whatsoever?
Your thoughts are most welcome and I thank you in advance for sharing your thoughts!
Invexi - a Phoenix, AZ based web design and web development company.
Run for the hills! Internet traffic doubles/triples during a major sports event? Who could have known!
That's about as worthy of an article as one "discovering" Euro Cup 2008 matches causes certain European streets to be abandoned for ninety minutes.
I can understand how such a traffic increase would be reason for alarm for the average network administrator, but you'd think service providers whose main business is the infrastructure would be aware of major streaming events. This shouldn't have surprised so many people.
Maybe we need a better streaming video mechanism for popular live streams? I would imagine that if everyone's watching the same thing at the same time, it ideally shouldn't take up any more bandwidth than, say, one compressed standard definition cable channel. Signed, naive chemist.
Just thought of something. Was mozilla.org hosting US Open highlight clips yesterday or something? Because that would explain a lot.
Did it occur to them to examine the contents of this supposed DDoS? You know, take a look at the source / destination IPs and perhaps a sampling of packet payloads in an attempt to figure out what was going on?
I'm not in favor of indiscriminate snooping, but as a security professional, this would be the first thing I would expect.
Fortunately Hong Kong's Star Sports was accessible through Sopcast P2P. That's awesome. Someone in the US (I assume you're in the US, since you referred to NBC and not some other network) had to watch a US sporting event by bouncing off a server in China.
The best part? It's not really all that impressive nowadays. But the entire concept was unthinkable to most people even 10 years ago.
God invented whiskey so the Irish would not rule the world.
How could this possibly be confused with a DDOS attack?
It makes me nervous that it even got to that point. How can a competent ISP confuse DDOS attacks with streaming video (most likely, the same streaming video sent to all people)? Isn't there a pattern there? Couldn't they see the connections were all coming from the same server or block of servers? Couldn't they see all of the connections were using the same protocol? Couldn't they see they were all using the same port?
How the hell do they confuse that with a DDOS? I am just a lowly part-time IT network manager at my company and even I can see the difference between streaming video and "other bad stuff".
Someone smarter than me please help me understand more about this. How did this get far enough to convince the ISP's they were being DDOS'd?
I guess I was part of the problem. I watched a good portion of it, at least the first nine holes until it switched to NBC coverage where my MythTV DVR could record it (the first half was on ESPN, and I don't get cable).
I was surprised at how good the video looked. I have tried several other events in the past, and have always been disappointed, or completely unable to view it. Although, for the NCAA Final Four this year, I was finally able to actually watch a game after failing the last few years. I had to use Win2K within a VMware VM, but it did work.
The U.S. Open video worked directly from my Mac, had decent sized video, and was completely watchable on my laptop. Nice job USGA, NBC, etc.
All these moves to charge per usage is going to blow up in their face.
They're worried this kind of usage will eat into their own TV viewership. What better way to prevent that from happening than by charging those who use it.
What will end up happening is customers will get in a tizzy and without suitable alternatives lawsuits will fly.
In the end either they'll have to abandon these plans or competition will be forced into the market.
-- taking over the world, we are.
Yep, this is exactly the sort of situation that IP Multicast was created for. It has been part of the IP RFCs since forever. Maybe more incidents like this will convince more ISPs to configure their routers to support it, so we could start using it.
The kiloclit