Conficker or Downadup, large anti-virus downloads can take your Internet connection down

We have seen multiple instances lately where customers have called and complained that their Internet connection was going down at various periods of the day. The customers were absolutely sure that something was wrong with their circuit and called our NOC to ask for troubleshooting assistance. Interestingly enough, we have traced the failures back to a single issue with each of these customers.

1. The first key we found was that the customer thought their internet connection was going down for short periods of time on a regular basis. It never seemed to be for more than a few minutes.
2. Once we proved that the circuit was not going down but was receiving a large increase in the volume of bandwidth, the customer wanted to know why they were receiving a denial of service attack. The source of the increased bandwidth did come from a small set of IP addresses.
3. Working with several customers, we were able to positively identify that the source IP addresses were a cluster of servers from Akamai on our network. We were also able to identify that the receiptient of the increased bandwidth, in each case, was a PC, server, or set of PCs downloading virus definition updates. This was accomplished by having the local IT department actually verify that the target IP was in fact a PC downloading the virus definitions/engine.

One particular customer who had a 20mb Ethernet connection was actually receiving 27mb of bandwidth during the downloads. I hope that this post can help other network providers or enterprise customers to pinpoint these short term specific issues.