Is BGP update storm a sign of trouble: Observing the internet control and data planes during internet worms

Abstract

There are considerable reasons to wish to understand the relationship between the Internet's control and data planes in times for stress. For example, the much publicized Internet worms - Code Red, Nimda and SQL Slammer - caused BGP storms, but there has been comparatively little study of whether the storms impacted network performance. In this paper, we study these worm events and see whether the BGP storms observed during the worms actually corresponded to problems in the Internet's data plane. By processing and analyzing two datasets from RIPE, we have found that while BGP update storms occurred in all three worms, the performance of the data plane degraded during the Slammer worm but did not during the Code Red and the Nimda. No direct correlation should be drawn between the degradation of the Internet data plane and the occurrence of a BGP update storm - it may not be a sign of trouble but a sign of the Internet control plane doing its job.