Packets, Ports, and Protocols

On the evening of November 2, 1988, a program began copying itself from computer to computer across the early internet. By the next morning it had reached thousands of computers at universities, research labs, and military sites. One estimate at the time put the count as high as 6,000 of the roughly 60,000 computers then connected, and many of the infected ones had slowed almost to a stop. It didn't trick anyone into opening anything. It knocked on programs that were waiting for messages from other computers, and some of those programs let it in.

Nothing large crosses a network in one piece. A web page, a video frame, or an email is cut into packets of usually no more than about 1,500 bytes each, and every packet carries a header in front of its share of the data. The header holds the IP addresses of the sender and the destination, which protocol the packet follows, and two port numbers. Routers read the addresses to pass the packet along; the receiving computer reads the rest to put the pieces back together and hand them to the right program. On the ARPANET, the machines that passed packets along were Interface Message Processors, made by the firm BBN. The first one reached UCLA on August 30, 1969, and the ARPANET grew into the internet the worm crossed.

Here is what one laptop's list of network activity looked like a minute after a student opened a web page, joined a video call, and started an online game, the kind a command like netstat shows. The addresses are made up.

Two of the rows use TCP and two use UDP. The UDP ones are both live, a call and a game, where a late packet is worse than a missing one. TCP sets up a connection first, numbers the data it sends, and resends any that goes missing, so a page or a download arrives complete and in order, a little later if need be. UDP sends each packet once and goes on to the next. A video call that waited for a lost packet would freeze; it skips the gap and keeps going.

An IP address gets a packet to the right computer, and the port number gets it to the right program on that computer. A program that serves others, such as a web server, listens on a fixed, well-known port, so anyone can find it: 443 for HTTPS, 80 for plain HTTP, 53 for DNS, 25 for email between mail servers. The program that starts a conversation, like the student's browser, takes any free high-numbered port for the reply to come back to, so the laptop's side of the table shows numbers in the 50,000s and 60,000s.

An open port is a program waiting for messages, often from strangers, and the worm went looking for three. On many computers the mail program, sendmail, listening on port 25, had been left with a debugging mode switched on that would run commands sent to it. A service called finger, on port 79, which answered questions about who was signed in, would overrun its memory when sent a request longer than it expected, and the worm used that to run its own code on VAX computers. It also used two remote sign-in services. One, rsh, let in any computer listed as a friend without a password. The other, rexec, took a password, and on each computer it reached, the worm guessed users' passwords from a list of common words and tried them on other computers where the same people had accounts. Think about what those three ways in would have found on a computer where none of those services was listening.

On such a computer the worm would have found no way in: with nothing listening on those ports, its messages had nothing to answer them. On the computers it did reach, it checked whether a copy was already running, but one copy in seven skipped that check and never shut down, probably so that a fake copy planted by administrators couldn't talk it into quitting. Copies piled up until the computers ran out of room to run anything else. VAX computers, made by Digital Equipment Corporation, were a mainstay of university computing centers, and one stalled VAX stopped work for everyone signed in to it.

Its author was Robert Tappan Morris, a 22-year-old graduate student at Cornell, who later said he had wanted to gauge how big the internet was. A federal jury in Syracuse convicted him in 1990 under the Computer Fraud and Abuse Act, the first conviction under that law, and he was sentenced to three years of probation, 400 hours of community service, and fines of about 10,000 dollars. Within weeks of the worm, the government funded a team at Carnegie Mellon to coordinate responses to attacks like it, the first of what are now called computer emergency response teams.