CERT.br - Distributed Honeypots Project

FLOWS

Daily Statistics -- 2012-05-14

This page presents the 2012-05-14 daily statistics for the network flow data directed to honeypots from the Distributed Honeypots Project. The X axis of each graphic represents a 24-hour time window (GMT). And the Y axis represents the total amount of bytes received per time slot, normalized to the number of subnets being monitored by our honeypots. You can see some observations at the bottom of this page.

Source Country Codes (CC)

#	Key	CC		Name	Total		Max	Avg
01			DE	Germany	12.23 MB	38.05 %	204.51 B/s	141.57 B/s
02			CN	China	6.50 MB	20.21 %	550.36 B/s	75.21 B/s
03			US	United States	5.49 MB	17.08 %	13.28 KB/s	63.57 B/s
04			SA	Saudi Arabia	1.17 MB	3.64 %	486.85 B/s	13.55 B/s
05			FR	France	972.30 KB	3.02 %	151.20 B/s	11.25 B/s
06			BR	Brazil	836.50 KB	2.60 %	44.87 B/s	9.68 B/s
07			TW	Taiwan, Province of China	501.66 KB	1.56 %	180.40 B/s	5.81 B/s
08			EC	Ecuador	456.11 KB	1.42 %	267.91 B/s	5.28 B/s
09			KR	Korea, Republic of	329.67 KB	1.03 %	73.82 B/s	3.82 B/s
10			IT	Italy	286.63 KB	0.89 %	137.25 B/s	3.32 B/s
11		Others			3.37 MB	10.49 %	555.39 B/s	39.03 B/s

top

Source AS Numbers (ASN)

#	Key	ASN	Name	CC		Total		Max	Avg
01		3209	VODANET Vodafone D2 GmbH		DE	12.17 MB	37.85 %	202.98 B/s	140.85 B/s
02		4134	CHINANET-BACKBONE No.31,Jin-ro...		CN	4.52 MB	14.06 %	367.10 B/s	52.32 B/s
03		23033	WOW - Wowrack.com		US	4.21 MB	13.10 %	13.28 KB/s	48.73 B/s
04		35388	JEEL-AS Arabic Computer System...		SA	1.12 MB	3.47 %	483.22 B/s	12.93 B/s
05		9394	CRNET CHINA RAILWAY Internet(C...		CN	965.90 KB	3.00 %	292.38 B/s	11.18 B/s
06		16276	OVH OVH Systems		EU	537.53 KB	1.67 %	8.61 B/s	6.22 B/s
07		4837	CHINA169-BACKBONE CNCGROUP Chi...		CN	531.59 KB	1.65 %	207.34 B/s	6.15 B/s
08		27757	CORPORACION NACIONAL DE TELECO...		EC	452.25 KB	1.41 %	267.91 B/s	5.23 B/s
09		12322	PROXAD Free SAS		FR	429.43 KB	1.34 %	144.31 B/s	4.97 B/s
10		10954	SERPRO - Empresa do MinistA©ri...		BR	339.36 KB	1.06 %	3.95 B/s	3.93 B/s
11		Others				6.88 MB	21.39 %	565.90 B/s	79.58 B/s

top

Protocols

#	Key	Protocol	Total		Max	Avg
01		TCP	26.86 MB	83.53 %	898.47 B/s	310.84 B/s
02		UDP	5.03 MB	15.63 %	13.28 KB/s	58.17 B/s
03		ICMP	265.69 KB	0.83 %	11.41 B/s	3.08 B/s
04		Others	2.15 KB	0.01 %	1.30 B/s	0.02 B/s

top

Destination TCP Ports

#	Key	Port	Name	Total		Max	Avg
01		445	Microsoft-DS Active Directory	15.07 MB	56.11 %	353.28 B/s	174.42 B/s
02		22	SSH (Secure Shell)	8.55 MB	31.85 %	629.97 B/s	99.01 B/s
03		139	NETBIOS Session Service	951.32 KB	3.54 %	105.00 B/s	11.01 B/s
04		80	HTTP (Hypertext Transfer Protocol)	806.72 KB	3.00 %	26.91 B/s	9.34 B/s
05		9988	Rbot/SpyBot	495.81 KB	1.85 %	199.27 B/s	5.74 B/s
06		3389	RDP (Microsoft Terminal Server)	94.98 KB	0.35 %	6.57 B/s	1.10 B/s
07		42	WINS	79.93 KB	0.30 %	166.37 B/s	0.93 B/s
08		1433	Microsoft SQL Server	70.12 KB	0.26 %	19.98 B/s	0.81 B/s
09		1080	SOCKS	64.33 KB	0.24 %	58.76 B/s	0.74 B/s
10		8080	HTTP Proxy	55.45 KB	0.21 %	12.25 B/s	0.64 B/s
11		Others		613.89 KB	2.29 %	95.42 B/s	7.11 B/s

top

Destination UDP Ports

#	Key	Port	Name	Total		Max	Avg
01		5060	SIP (Session Initiation Protocol)	4.45 MB	88.59 %	13.28 KB/s	51.54 B/s
02		137	NETBIOS Name Service	331.90 KB	6.60 %	7.85 B/s	3.84 B/s
03		138	NETBIOS Datagram Service	25.19 KB	0.50 %	0.29 B/s	0.29 B/s
04		6257	n/a	18.99 KB	0.38 %	2.90 B/s	0.22 B/s
05		53	DNS (Domain Name System)	17.14 KB	0.34 %	4.46 B/s	0.20 B/s
06		161	SNMP (Simple Network Management Protocol)	6.77 KB	0.13 %	6.39 B/s	0.08 B/s
07		3544	n/a	2.89 KB	0.06 %	1.68 B/s	0.03 B/s
08		4684	n/a	2.44 KB	0.05 %	3.85 B/s	0.03 B/s
09		51693	n/a	1.81 KB	0.04 %	0.02 B/s	0.02 B/s
10		43303	n/a	1.74 KB	0.03 %	1.78 B/s	0.02 B/s
11		Others		164.43 KB	3.27 %	8.57 B/s	1.90 B/s

top

Source Operating Systems (Windows)

#	Key	Operating System	Total		Max	Avg
01		Windows-XP-RFC1323	7.27 MB	58.22 %	119.75 B/s	84.14 B/s
02		Windows-XP-SP1/Windows-2000-SP4	1.50 MB	12.04 %	239.35 B/s	17.40 B/s
03		Windows-2000/Windows-XP	1.25 MB	10.05 %	179.30 B/s	14.53 B/s
04		Windows-2000-RFC1323/Windows-XP-RFC1323	898.92 KB	7.20 %	71.21 B/s	10.40 B/s
05		Windows-XP-SP1/Windows-2000-SP3	835.36 KB	6.69 %	234.28 B/s	9.67 B/s
06		Windows-XP-SP1/Windows-2000-SP2+	714.31 KB	5.72 %	144.66 B/s	8.27 B/s
07		Windows-98	9.16 KB	0.07 %	2.96 B/s	0.11 B/s
08		Windows-XP-cisco/Windows-2000-cisco	27.00 B	0.00 %	0.06 B/s	0.00 B/s
09		Windows-XP/Windows-2000-SP2	22.50 B	0.00 %	0.03 B/s	0.00 B/s
10		Windows-98-noSack	22.34 B	0.00 %	0.07 B/s	0.00 B/s
11		other-Windows	40.80 B	0.00 %	0.06 B/s	0.00 B/s

top

Source Operating Systems (Other platforms)

#	Key	Operating System	Total		Max	Avg
01		unknown	7.51 MB	52.28 %	509.13 B/s	86.95 B/s
02		Linux	3.66 MB	25.45 %	490.18 B/s	42.33 B/s
03		undefined	3.19 MB	22.21 %	73.77 B/s	36.95 B/s
04		SunOS	4.82 KB	0.03 %	3.01 B/s	0.06 B/s
05		ExtremeWare-4.x	2.57 KB	0.02 %	3.01 B/s	0.03 B/s
06		Solaris	829.63 B	0.01 %	1.49 B/s	0.01 B/s
07		NetBSD	345.50 B	0.00 %	0.42 B/s	0.00 B/s
08		OpenBSD	32.00 B	0.00 %	0.11 B/s	0.00 B/s
09		PocketPC-2002	0.75 B	0.00 %	0.00 B/s	0.00 B/s
10		Others	0.00 B	0.00 %	0.00 B/s	0.00 B/s

top

Observations:

Each image above contains a STACK AREA graphic, which means that each data set of the graphic is stacked on top of the previous one.
Lists of known TCP/UDP ports and associated service names can be found at the following documents:
- Port Numbers, from IANA.
- List of TCP and UDP port numbers, from The Wikipedia.
- Common Ports, from packetlife.net.
A list of known Country Codes can be found at IANA. The country code "XX" stands for network flows that could not be associated with any country code, for example, flows from private networks.