1. FlowScan at the University of Wisconsin Perry Brunelli, Network Services

2. Flowscan - freely available perl scripts and modules that aggregate other freely available tools for representing flows Analyzes and reports on NetFlow data collected by CAIDA’s clfowd Stored using RRDtool - time series data Flowscan provides reporting capabilities and visualization of flow data Measurement Tools – FlowScan

3. See: http://net.doit.wisc.edu/~plonka/lisa/FlowScan/ http://net.doit.wisc.edu/~plonka plonka@doit.wisc.edu Dave -> For more on Flowscan

4. Fall 2000 Traffic

5. Fall 2000 Traffic - Continued

6. Fall 2001 Traffic

7. Fall 2001 Traffic – Continued

8. A look at the past year

9. Network Events of Interest

10. Code Red Worm Propagation The following graph shows the difference between the number of UW-Madison IP addresses that have transmitted traffic and the number that have received traffic. These values are plotted independently for each of UW-Madison's four class B networks. This metric represents the number of campus host IP addresses that participated in "monologues" - one way exchanges of IP information with hosts in the outside world. A negative value indicates that more src addresses have been used as received IP traffic than have generated outbound IP traffic. Negative numbers in the plot are an indication of inbound "scanning" or probing behavior (such as that done by the hosts in the outside world that were infected with the Code Red worm) because those scans often attempt to talk to unused campus IP addresses or to hosts which simply do not respond because of firewall policies.

11. Code Red Worm Propagation

12. DOS Attack On Monday, July 9, 2001, UW-Madison network engineers discovered that for the past two days, various campus hosts running the Windows IIS HTTP server were enlisted as slaves in an outbound Distributed-Denial-of-Service attack. The outbound traffic consisted of large ICMP ECHO packets to a small set of destination "victim" hosts.

13. Outbound DDoS flood from 30+ hosts in 128.104/16

14. WiscNet Traffic

15. WiscNet by Protocol