Re: [cobalt-users] SQL Worm

["E.B. Dreger" <eddy+public+spam@xxxxxxxxxxxxxxxxx>]

DT> Date: Sun, 26 Jan 2003 11:52:27 -0600
DT> From: Mailing List (David Thurman)


DT> I think this hit about midnight EST and crippled the net
DT> pretty bad. UUNet seemed to take a big knock
DT> http://www.internetpulse.com showed red for all UUNet Sat
DT> most the day. All seems back to normal now.

0530 GMT Saturday morning.  Many providers began blocking it
fairly quickly; UUNet was blocking UDP/1434 within an hour of
the attack.  Most people noted a substantial decrease in worm
traffic a few hours after the attack began, as port filtering
was implemented by various networks.

However, there were networks that were slow to respond.  Some
routers crashed, and many BGP sessions flapped.  Both of these
had cascading effects on latency and packet loss.  Situations
like these are where it's a good idea to have OOB access.

As much as I dislike WorldCom as a company, UUNet has an
_excellent_ security department.  Chris, Brian, and the others
are very clueful and responsive.  If all networks had guys like
them, we wouldn't have problems like this.

Okay, this is OT.  Bottom line:  Yes, the worm caused much
traffic disruption.  Packet loss wreaks havoc.


Eddy
--
Brotsman & Dreger, Inc. - EverQuick Internet Division
Bandwidth, consulting, e-commerce, hosting, and network building
Phone: +1 (785) 865-5885 Lawrence and [inter]national
Phone: +1 (316) 794-8922 Wichita

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
From: A Trap <blacklist@xxxxxxxxx>
To: blacklist@xxxxxxxxx
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots.
Do NOT send mail to <blacklist@xxxxxxxxx>, or you are likely to
be blocked.