Path: utzoo!utgpu!jarvis.csri.toronto.edu!rutgers!tut.cis.ohio-state.edu!cica!iuvax!ux1.cso.uiuc.edu!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: David.M..Chess.CHESS@YKTVMV
Newsgroups: comp.virus
Subject: Internet worm impact (UNIX & Internet)
Message-ID: <0007.8911201547.AA05782@ge.sei.cmu.edu>
Date: 20 Nov 89 00:00:00 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 24
Approved: krvw@sei.cmu.edu

Alan Roberts, commenting on Pam Kane's book, writes:

>                            We know that 50% of the connections were
> downfor 24 hours and some (including ARPANET) were down for up to 4
> days.

Do we really know that?  That sounds somewhat more severe than numbers
I've heard elsewhere.  ARPANET being down for 4 days is *certainly*
new news to me.  The most recent estimate on the number of systems the
worm actually ran on (and I'm afraid I've forgotten the source for the
moment!) was 2500; seems unlikely that that (or even the earlier 6000
figure) would have killed 50% of the links for 24 hours.  Are the
numbers you quote from any published source I could get and read?  The
(very early) reports in the Seeley, Spafford and Eichlin/Rochlis
papers didn't give me the impression that the impact on connectivity
was that severe, and one chronology says (attributing it to Stoll)
that the virus was "pretty much eliminated" by 1800 on 11/4, which is
only 48 hours after it was first noticed.

I'm not trying to argue that Alan is wrong, of course.  I'm only
surprised and curiosified by his numbers, and would like to read
whatever it was they came from.

DC