FlowScan at the University of Wisconsin

Perry Brunelli, Network Services

• Flowscan - freely available perl scripts and modules that aggregate other freely available tools for representing flows

• Analyzes and reports on NetFlow data collected by CAIDA’s clfowd

• Stored using RRDtool - time series data

• Flowscan provides reporting capabilities and visualization of flow data

Measurement Tools – FlowScan

See:

• http://net.doit.wisc.edu/~plonka/lisa/FlowScan/

• http://net.doit.wisc.edu/~plonka

plonka@doit.wisc.edu

Dave ->

For more on Flowscan

Fall 2000 Traffic

Fall 2000 Traffic - Continued

Fall 2001 Traffic

Fall 2001 Traffic – Continued

A look at the past year

Network Events of Interest

Code Red Worm Propagation The following graph shows the difference between the number of UW-Madison IP addresses that have transmitted traffic and the number that have received traffic. These values are plotted independently for each of UW-Madison's four class B networks. This metric represents the number of campus host IP addresses that participated in "monologues" - one way exchanges of IP information with hosts in the outside world. A negative value indicates that more src addresses have been used as received IP traffic than have generated outbound IP traffic. Negative numbers in the plot are an indication of inbound "scanning" or probing behavior (such as that done by the hosts in the outside world that were infected with the Code Red worm) because those scans often attempt to talk to unused campus IP addresses or to hosts which simply do not respond because of firewall policies.

Code Red Worm Propagation

DOS Attack On Monday, July 9, 2001, UW-Madison network engineers discovered that for the past two days, various campus hosts running the Windows IIS HTTP server were enlisted as slaves in an outbound Distributed-Denial-of-Service attack. The outbound traffic consisted of large ICMP ECHO packets to a small set of destination "victim" hosts.

Outbound DDoS flood from 30+ hosts in 128.104/16

WiscNet Traffic

WiscNet by Protocol