flowscan at the university of wisconsin
DESCRIPTION
FlowScan at the University of Wisconsin. Perry Brunelli, Network Services. Measurement Tools – FlowScan. Flowscan - freely available perl scripts and modules that aggregate other freely available tools for representing flows Analyzes and reports on NetFlow data collected by CAIDA’s clfowd - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/1.jpg)
FlowScan at the University of Wisconsin
Perry Brunelli, Network Services
![Page 2: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/2.jpg)
• Flowscan - freely available perl scripts and modules that aggregate other freely available tools for representing flows
• Analyzes and reports on NetFlow data collected by CAIDA’s clfowd
• Stored using RRDtool - time series data
• Flowscan provides reporting capabilities and visualization of flow data
Measurement Tools – FlowScan
![Page 3: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/3.jpg)
See:
• http://net.doit.wisc.edu/~plonka/lisa/FlowScan/
• http://net.doit.wisc.edu/~plonka
Dave ->
For more on Flowscan
![Page 4: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/4.jpg)
Fall 2000 Traffic
![Page 5: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/5.jpg)
Fall 2000 Traffic - Continued
![Page 6: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/6.jpg)
Fall 2001 Traffic
![Page 7: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/7.jpg)
Fall 2001 Traffic – Continued
![Page 8: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/8.jpg)
A look at the past year
![Page 9: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/9.jpg)
Network Events of Interest
![Page 10: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/10.jpg)
Code Red Worm Propagation The following graph shows the difference between the number of UW-Madison IP addresses that have transmitted traffic and the number that have received traffic. These values are plotted independently for each of UW-Madison's four class B networks. This metric represents the number of campus host IP addresses that participated in "monologues" - one way exchanges of IP information with hosts in the outside world. A negative value indicates that more src addresses have been used as received IP traffic than have generated outbound IP traffic. Negative numbers in the plot are an indication of inbound "scanning" or probing behavior (such as that done by the hosts in the outside world that were infected with the Code Red worm) because those scans often attempt to talk to unused campus IP addresses or to hosts which simply do not respond because of firewall policies.
![Page 11: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/11.jpg)
Code Red Worm Propagation
![Page 12: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/12.jpg)
DOS Attack On Monday, July 9, 2001, UW-Madison network engineers discovered that for the past two days, various campus hosts running the Windows IIS HTTP server were enlisted as slaves in an outbound Distributed-Denial-of-Service attack. The outbound traffic consisted of large ICMP ECHO packets to a small set of destination "victim" hosts.
![Page 13: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/13.jpg)
Outbound DDoS flood from 30+ hosts in 128.104/16
![Page 14: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/14.jpg)
WiscNet Traffic
![Page 15: FlowScan at the University of Wisconsin](https://reader034.vdocuments.net/reader034/viewer/2022052603/56814751550346895db493e3/html5/thumbnails/15.jpg)
WiscNet by Protocol