Internet Worms and Global Routing Instabilities

We analyze the global BGP routing instabilities observed during the Code Red II and Nimda worm attacks in July and September 2001, respectively. Compelling analysis is shown on the correlation between the observed instabilities and the worm attacks. We analyze router failure modes that can be triggered by the abnormal traffic during the worm attack and how they can lead to global routing instability. Independent research has partially confirmed that such failure modes can and likely do occur in practice. Highly detailed large-scale simulations help close the loop, indicating that such failure modes do in fact trigger the kind of widespread BGP instabilities that were observed empirically.