What are these stripes in the firewall log data?

I took five days or so worth of firewall log data from a us state government agency, and sent ip's to a company called quova; quova took every 40th one and gave me back full location info on it. I then grabbed all activity for those ip's from the logs, and graphed it very simply: count of inbound packets, grouped by country of origin and hour. There are striking patterns in this data. Can someone tell me why (I *think* I know already)?

Category:

Science & Technology

Tags:

• ip
• country
• botnet
• hacking
• firewall
• log
• traffic
• graph
• data
• visualization
• virtual
• world
• internet
• tcpip
• green
• phosphor
• glasshouse
• quova

[coldironhands1]

it's called day and night, idiot

[arkowitz]

@coldironhands1 Sorry, wrong answer. The interesting thing about this shite is that it DOESN'T correspond to day and night. Day and night happen at different times around the world, and this activity is coming from all over the world but stopping and starting in synchrony.

[sbaker48]

Thank UPnP and gamers? Maybe the "state agency employees" are busy all day, say M-F screwing around on sites they aren't supposed to visit (notice the list of countries) Brazil always has VoIP and video conferences going, explains that! Or perhaps, if not initiated internally....these are automated responses, to some stimuli, seemingly beginning on a single date, and each country showing a similar rate of increase very suddenly, no?

[arkowitz]

Good theory but as this video shows, the majority of the traffic is port 137, port 53, and ICMP:

watch?v=4K4QmpTCtDc

By the way, without filtering US-originated traffic, all of this is completely drowned out by the huge humps of traffic from 8am to 5pm of the employees browsing the web.

[blad3runn69]

the log is pretty much meaningless without context. What is the firewall sitting on - DOD or Disney servers? What do the packets contain - ICMP or fragmented packets? Are they malicious or just routine traffic? Cool log GUI though

[arkowitz]

Did you watch this one

watch?v=4K4QmpTCtDc

I think it helps explain what's going on. As far as what the firewall is sitting on, it's nothing so exciting as DOD or Disney.

[shingetters]

guitar hero? =P

[MalachorWraith]

You hit the button on the guitar while "strumming" the switch and it makes it play Weezer on the xbox.

[coldironhands1]

@arkowitz well if it was disney, they'd be havign their kids watch videos and shit when they wake up or go to be, if it's DoD it's cyber terrorists. You should back trace all of them and show the cyber police.

[DJ2RUD3]

yeah guitar hero lol red green yellow yellow blue geen together cool game maybe he was playing that and it froze so he took a picture

[freakwars1]

looks like guitar hero

[Mohannad192]

hi just saw this video,

the tool looks very helpful, is it self developed or is a comercial product ??

but regarding the stripes pattern it may be data pulling since its systematic without the application port you can never tell, though one thing is intersting the stripes started after a certain time they werent there in the begining of the graph,

i think you need to check the application ports, but good i like the conspericy theory behind it :)

[marquesbrownlee]

Everyone in the world gets on Skype at the same time. lol

[DJ2RUD3]

this is the new cyber BURBERRY design

[bonchbonch]

You mentioned the company in the Slashdot submission and video description. When you don't mention your affiliation, it makes people wonder if the video only exists to create viral hype for the software and if the data was specifically set up in a way that gets people talking.

I'm not bashing you, just saying you should've mentioned your affiliation. I doubt anybody would have a problem if you had. Slashdot has a reputation for unwittingly posting advertisements now and then.

[blad3runn69]

cool thanks. global network activity analysis is interesting stuff. the activity does look automated. Can you analyse the packets - what's in them?