Subject: RE: [Ieprep] FW: The Spread of the Sapphire/Slammer SQL Worm

From: "Nguyen, An" <[email-masked]>
Date: Sun, 2 Feb 2003 12:04:11 -0500

An artcile from CNN said the SQL worm started from the Pac Rim, mainly from
Hongkong and South Korea. And it spread to the Europe and the US. I wonder
it caused any  considerable stress for the Internet backbone. 

An
-----Original Message-----
From: Ayyasamy, Senthilkumar
(UMKC-Student)JavaScript:parent.DoCommand("send",
parent.form_fr.document.mainForm)
Send
To: [email-masked]
Sent: 1/31/03 9:11 PM
Subject: [Ieprep] FW: The Spread of the Sapphire/Slammer SQL Worm

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, January 31, 2003 7:13 PM
To: [email-masked]
Subject: The Spread of the Sapphire/Slammer SQL Worm

We have completed our preliminary analysis of the spread of the
Sapphire/Slammer SQL worm.  This worm required roughly 10 minutes to
spread worldwide making it by far the fastest worm to date.  In the
early stages the worm was doubling in size every 8.5 seconds.  At its
peak, achieved approximately 3 minutes after it was released, Sapphire
scanned the net at over 55 million IP addresses per second.  It
infected at least 75,000 victims and probably considerably more.

This remarkable speed, nearly two orders of magnitude faster than Code
Red, was the result of a bandwidth-limited scanner.  Since Sapphire
didn't need to wait for responses, each copy could scan at the maximum
rate that the processor and network bandwidth could support.

There were also two noteworthy bugs in the pseudo-random number
generator which complicated our analysis and limited our ability to
estimate the total infection but did not slow the spread of the worm.

The full analysis is available at
http://www.caida.org/analysis/security/sapphire/
http://www.silicondefense.com/sapphire/
http://www.cs.berkeley.edu/~nweaver/sapphire/

David Moore, CAIDA & UCSD CSE
Vern Paxson, ICIR & LBNL
Stefan Savage, UCSD CSE
Colleen Shannon, CAIDA
Stuart Staniford, Silicon Defense
Nicholas Weaver, Silicon Defense and UC Berkeley EECS
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Bill Woodcock <[email-masked]>
Date: Sun, 2 Feb 2003 10:57:35 -0800 (PST)

> it caused any  considerable stress for the Internet backbone.

Yes, it did.  That's what an emergency looks like from our point of view.

It caused very large problems, but was basically contained within four
hours, everywhere that mattered, due in large part to the excellent
communications which now obtain between ISP NOCs.

However, the worm wasn't a particularly virulent one, and four hours could
be much improved upon.

                                -Bill

---

From: Sean Donelan <[email-masked]>
Date: Sun, 2 Feb 2003 23:04:43 -0500 (EST)

This is a personal opinion, and does not necessarily reflect the views of
anyone else.

For close to 2 years I've been promoting the position we need to deploy
some VOIP phones, and get experience using them during periods of severe
network stress.  We need understand what the problems in the real
world are, while working on things which could improve their performance.

Its seems like we just had an excellent opportunity to collect some real
world data.

Did anyone collect any data?

> communications which now obtain between ISP NOCs.

I was at home, and didn't loose e-mail communications throughout the
incident. FYI, I'm in California, my personal e-mail is in Maryland.
So I was criss-crossing the US twice to read my e-mail.  I was exchanging
e-mail with network engineers around the world throughout the night with
no noticeble problems.  But e-mail tends to be very elastic.

Unfortunately, I left my INOC-DBA phone at the office, so I wasn't able
to try it during the height of the incident. How well did VOIP work
during the height of the UDP storm?  Would SIP priority have changed how
well the VOIP UDP packets got through during periods of severe Internet
congestion?  Or were the real problems somewhere else?