Sapphire/Slammer Worm Impact on Internet Performance

SQLSlammer was one of the largest impacts on routing caused by the release of malicous code. This report looks at the effects and presents several measurements during the worm's outbreak in January, 2003.

Looking at all data we can conclude that the Internet did not come to a global "meltdown" even though some individual sites were highly affected by this worm. Sixty percent of the measured relations do not show any sign of deterioration. This indicates most backbone links were fine and the problems were localized in edge sites or their immediate upstream provider. Also, eleven of the thirteen root servers remained accessible.

This data clearly shows that many of the routine measurements taken by the RIPE NCC can be used to detect widespread problems in the Internet infrastructure and to differentiate them from local problems. This can be crucial information to NOCs at the time of a problem. We are investigating how we can combine this data and make it available in real time.

Source: Sapphire/Slammer Worm Impact on Internet Performance, James Aldridge, Daniel Karrenberg, Henk Uijterwaal and René Wilhelm, New Projects Group / RIPE NCC, February 10, 2003.