FYI...

- http://asert.arbornetworks.com/2008/03/2-of-internet-traffic-raw-sewage/
March 31, 2008 - "...We’ve currently got 68 discrete ISPs participating, covering over 100k interfaces on nearly 1300 routers, and peak inter-domain traffic rates are currently nearing 1.5 Tbps, which is a statistically significant number. We currently see somewhere around 1300 DDoS attacks a day on average, we’ve seen nearly 1 million since we began the program, and we’re getting to a point where after 1.5 years of collection, some trends are beginning to emerge. For example, attack frequency seems to drop significantly on Christmas Day, New Year’s Eve, and New Years Day (perhaps while the miscreants are either hung over or expending their spoils. The most common targets we see are IRC servers, although those attacks are usually lower-scale and not as well distributed as some of the larger attacks. The most common attack vectors are TCP SYN floods, with ICMP floods being a close second. It’s also particularly interesting to compare and contrast protocol distributions (e.g., peer-2-peer, http, etc..) and rates for inter-domain traffic versus broadband dense segments or other demographics... one finding I did want to point out that was somewhat surprising is that DDoS (i.e., brute-force flood-based attacks) have over the past 18 months consistently accounted for ~1-3% of all all inter-domain Internet traffic. Again, this is raw attack traffic, simply meant to exhaust connection state or fill links, nowhere in this mix is spam, phishing, scans, or other malicious or similarly annoying traffic. We have seen peaks well above 5% of aggregate reported traffic, although not consistently. As you might suspect, that’s no small amount of wasted resources consumed by DDoS attack traffic..."