Is BGP update storm a sign of trouble: Observing the internet control and data planes during internet worms
Date
2006
Authors
Roughan, M.
Li, J.
Bush, R.
Mao, Z.
Griffin, T.
Editors
Obaidat, M.
Advisors
Journal Title
Journal ISSN
Volume Title
Type:
Conference paper
Citation
Proceedings of SPECTS 2006
Statement of Responsibility
Matthew Roughan, Jun Li, Randy Bush, Zhuoqing Mao and Timothy Griffin
Conference Name
International Symposium on Performance Evaluation of Computer and Telecommunication Systems (2003 : Calgary, Canada)
Abstract
There are considerable reasons to wish to understand the relationship between the Internet's control and data planes in times for stress. For example, the much publicized Internet worms - Code Red, Nimda and SQL Slammer - caused BGP storms, but there has been comparatively little study of whether the storms impacted network performance. In this paper, we study these worm events and see whether the BGP storms observed during the worms actually corresponded to problems in the Internet's data plane. By processing and analyzing two datasets from RIPE, we have found that while BGP update storms occurred in all three worms, the performance of the data plane degraded during the Slammer worm but did not during the Code Red and the Nimda. No direct correlation should be drawn between the degradation of the Internet data plane and the occurrence of a BGP update storm - it may not be a sign of trouble but a sign of the Internet control plane doing its job.