Subject: [Ieprep] Code-Red

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Mon, 18 Nov 2002 19:02:31 -0600

During Ran's presentation, their was a question regarding 
effect of code-red on the Backbone. 

As for referencee, take a peek at the caida plots which shows
the no of infected hosts. 
http://www.caida.org/dynamic/analysis/security/code-red/

Points relevant to ieprep:

- code-red primarily preyed upon small business users rather
than large corporate networks.

- If you look at the geographical distribution of the 
attack/loss statistics, one can conclude that backbone
will sustain such large scale effects.

(Moore. D., Shannon. C., claffy. k., "Code-Red: a case study 
on the spread and victims of an Internet worm," IMW -2002.
  http://www.icir.org/vern/imw-2002/program.html)

- Code-red and other worms are a continuing mystery. It is 
hard to predict their traffic pattern, attack tree
or come up with a solution. Their is nothing that a IETF group 
can do.

- BGP stability was affected to some degree. But, due to its
dynamic nature, routes reconverges eventually (although its 
take some time which lead to some prefix miss.)

Thus said, code-red/NIMDA is a non-issue for ieprep as

   *  Solutions to avoid code-red is nill. So, nothing can be 
      done except for patching your kernels with some security 
      fixes (if you use a ISS server)

   * If you are thinking of using QoS to prioritize emergency
     traffic, it provides better chance for worms to target the
     high-priority traffic i.e.emergency traffic.

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: David Meyer <[email-masked]>
Date: Mon, 18 Nov 2002 17:16:06 -0800

>> will sustain such large scale effects.

Please explain how "one can conclude that backbone will sustain
such large scale effects" and what those effects might be.

>> take some time which lead to some prefix miss.)

Please explain.

>>      high-priority traffic i.e.emergency traffic.

Please explain how.

Dave

---

From: Sean Donelan <[email-masked]>
Date: Tue, 19 Nov 2002 02:05:52 -0500 (EST)

http://www.council.nyc.ny.us/pdf_files/reports/9_11techreport.pdf
   Perhaps the most significant technology lesson learned after 9/11 was
   the greater durability and usefulness of the Internet compared to the
   traditional telephone network. According to Brian Cohen, a Deputy
   Commissioner at DoITT, "We'd never thought we'd lose the phones. But
   when we lost the phones, we still had the Internet." IT became a whole
   new medium of communication.
[...]
   VoIP, wireless networks, text-messaging systems such as Blackberries,
   and the Internet in general offered cost-effective, relatively stable
   platforms for information dissemination, multi-directional
   communication, and command and control after 9/11  to the point where
   the Mayors Office has kept its VoIP network instead of returning to
   Verizons telephone network. Indeed, these systems should not only serve
   a more integral role in emergency response planning, but they should
   also be incorporated into ongoing agency  practice. In the case of
   VoIP, the city of Houston has already begun deploying the technology
   and expects to eventually convert all 25,000 municipal phones to
   VoIP.