Study: High % of Internet traffic "sewage"

Traffic flowing between 68 ISPs has been monitored by Arbor Networks for the past 18 months. During that time they have registered that a significant percentage of that traffic consists of “malicious” or “raw flood” attacks, such as Denial of Service (DDoS) attacks.

Excluding other annoying traffic such as spam, scams and phishing, Arbor discovered the following:

- 1% - 3% of inter-domain traffic comprised of "meaningless packets of information" used in DDoS attacks

- 1300 DDoS attacks are registered each day

- Attack frequency drops significantly on Christmas Day, New Year’s Eve and New Years Day

- The most common targets are IRC servers

- Other malicious traffic accounts for 2% of overall inter-domain traffic

“As you might suspect,” said Danny McPherson, Arbor's chief research officer, in a recent blog post, “that’s no small amount of wasted resources consumed by DDoS attack traffic. TCP/25 (SMTP - email) seems to hover around 10-15 Gbps, so 1-1.5%. If you were to assume that only 66% of that is spam (which is likely a very low estimate, and one that varies rather widely), you get ~1%, so we’re at nearly 4% of all inter-domain traffic as junk, with over half being raw sewage.”

Tags: DDoS, Internet traffic, raw flood attack