1 / 15

FlowScan: Network Flow Analysis Tool at University of Wisconsin

FlowScan is a freely available tool for analyzing NetFlow data, providing reporting capabilities and visualizations. Learn more about FlowScan by Perry Brunelli at the University of Wisconsin. Explore Traffic Analysis from Fall 2000 to Fall 2001 and Network Events of Interest like Code Red Worm Propagation. Discover insights on UW-Madison's network traffic and security incidents.

jui
Télécharger la présentation

FlowScan: Network Flow Analysis Tool at University of Wisconsin

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. FlowScan at the University of Wisconsin Perry Brunelli, Network Services

  2. Measurement Tools – FlowScan • Flowscan - freely available perl scripts and modules that aggregate other freely available tools for representing flows • Analyzes and reports on NetFlow data collected by CAIDA’s clfowd • Stored using RRDtool - time series data • Flowscan provides reporting capabilities and visualization of flow data

  3. For more on Flowscan Dave -> plonka@doit.wisc.edu • See: • http://net.doit.wisc.edu/~plonka/lisa/FlowScan/ • http://net.doit.wisc.edu/~plonka

  4. Fall 2000 Traffic

  5. Fall 2000 Traffic - Continued

  6. Fall 2001 Traffic

  7. Fall 2001 Traffic – Continued

  8. A look at the past year

  9. Network Events of Interest

  10. Code Red Worm Propagation The following graph shows the difference between the number of UW-Madison IP addresses that have transmitted traffic and the number that have received traffic. These values are plotted independently for each of UW-Madison's four class B networks. This metric represents the number of campus host IP addresses that participated in "monologues" - one way exchanges of IP information with hosts in the outside world. A negative value indicates that more src addresses have been used as received IP traffic than have generated outbound IP traffic. Negative numbers in the plot are an indication of inbound "scanning" or probing behavior (such as that done by the hosts in the outside world that were infected with the Code Red worm) because those scans often attempt to talk to unused campus IP addresses or to hosts which simply do not respond because of firewall policies.

  11. Code Red Worm Propagation

  12. DOS Attack On Monday, July 9, 2001, UW-Madison network engineers discovered that for the past two days, various campus hosts running the Windows IIS HTTP server were enlisted as slaves in an outbound Distributed-Denial-of-Service attack. The outbound traffic consisted of large ICMP ECHO packets to a small set of destination "victim" hosts.

  13. Outbound DDoS flood from 30+ hosts in 128.104/16

  14. WiscNet Traffic

  15. WiscNet by Protocol

More Related