FlowScan at the University of Wisconsin Perry Brunelli, Network Services.
-
Upload
dale-nelson -
Category
Documents
-
view
219 -
download
0
Transcript of FlowScan at the University of Wisconsin Perry Brunelli, Network Services.
FlowScan at the University of Wisconsin
Perry Brunelli, Network Services
• Flowscan - freely available perl scripts and modules that aggregate other freely available tools for representing flows
• Analyzes and reports on NetFlow data collected by CAIDA’s clfowd
• Stored using RRDtool - time series data
• Flowscan provides reporting capabilities and visualization of flow data
Measurement Tools – FlowScan
See:
• http://net.doit.wisc.edu/~plonka/lisa/FlowScan/
• http://net.doit.wisc.edu/~plonka
Dave ->
For more on Flowscan
Fall 2000 Traffic
Fall 2000 Traffic - Continued
Fall 2001 Traffic
Fall 2001 Traffic – Continued
A look at the past year
Network Events of Interest
Code Red Worm Propagation The following graph shows the difference between the number of UW-Madison IP addresses that have transmitted traffic and the number that have received traffic. These values are plotted independently for each of UW-Madison's four class B networks. This metric represents the number of campus host IP addresses that participated in "monologues" - one way exchanges of IP information with hosts in the outside world. A negative value indicates that more src addresses have been used as received IP traffic than have generated outbound IP traffic. Negative numbers in the plot are an indication of inbound "scanning" or probing behavior (such as that done by the hosts in the outside world that were infected with the Code Red worm) because those scans often attempt to talk to unused campus IP addresses or to hosts which simply do not respond because of firewall policies.
Code Red Worm Propagation
DOS Attack On Monday, July 9, 2001, UW-Madison network engineers discovered that for the past two days, various campus hosts running the Windows IIS HTTP server were enlisted as slaves in an outbound Distributed-Denial-of-Service attack. The outbound traffic consisted of large ICMP ECHO packets to a small set of destination "victim" hosts.
Outbound DDoS flood from 30+ hosts in 128.104/16
WiscNet Traffic
WiscNet by Protocol