Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.milw.wisc.edu!bionet!apple!usc!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: CHESS@YKTVMV.BITNET (David M. Chess)
Newsgroups: comp.virus
Subject: VNET and the CHRISMA EXEC (IBM VM/CMS)
Message-ID: <0002.8907262036.AA10563@ge.sei.cmu.edu>
Date: 26 Jul 89 00:00:00 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 12
Approved: krvw@sei.cmu.edu

Your description of the VNET topology is essentially correct.   On the
other hand, I *don't* think it's the case that the backbone was taken
down at any time during the CHRISTMA incident.  As I say, I was on
vacation, but I think the response at most of the central nodes was
to run a filter; hastier reactions (shutting down, cold-starting, etc)
would have been more likely to have happened at "leaf" nodes, where
the operators were perhaps less experienced.

Just because the media like the "IBM's network was shut down" story,
don't assume it's true...    *8)

DC