Brazilian Honeypots Alliance

FLOWS

Daily Statistics -- 2010-09-05

This page presents the 2010-09-05 daily statistics for the network flow data directed to honeypots from the Brazilian Honeypots Alliance. The X axis of each graphic represents a 24-hour time window (GMT). And the Y axis represents the total amount of bytes received per time slot, normalized to the number of subnets being monitored by our honeypots. You can see some observations at the bottom of this page.

Source Country Codes (CC)

#	Key	CC		Name	Total		Max	Avg
01			CN	China	8.91 MB	15.88 %	667.29 B/s	103.16 B/s
02			BR	Brazil	7.51 MB	13.39 %	764.18 B/s	86.97 B/s
03			SE	Sweden	7.25 MB	12.92 %	1.90 kB/s	83.91 B/s
04			CA	Canada	6.80 MB	12.11 %	673.41 B/s	78.66 B/s
05			US	United States	4.04 MB	7.20 %	344.67 B/s	46.75 B/s
06			KR	Korea, Republic of	3.91 MB	6.97 %	440.80 B/s	45.30 B/s
07			DO	Dominican Republic	3.47 MB	6.19 %	80.08 B/s	40.21 B/s
08			TW	Taiwan, Province of China	2.19 MB	3.89 %	344.84 B/s	25.30 B/s
09			CO	Colombia	1.23 MB	2.18 %	513.00 B/s	14.19 B/s
10			FR	France	1.22 MB	2.16 %	193.51 B/s	14.07 B/s
11		Others			9.61 MB	17.12 %	804.89 B/s	111.22 B/s

top

Source AS Numbers (ASN)

#	Key	ASN	Name	CC		Total		Max	Avg
01		43948	GLESYS-AS GleSYS Internet Serv...		SE	7.23 MB	12.88 %	1.90 kB/s	83.70 B/s
02		6327	SHAW - Shaw Communications Inc...		CA	6.39 MB	11.38 %	651.51 B/s	73.93 B/s
03		4837	CHINA169-BACKBONE CNCGROUP Chi...		CN	3.64 MB	6.49 %	381.20 B/s	42.16 B/s
04		6400	CompaA±Aa Dominicana de TelA©...		DO	3.46 MB	6.16 %	80.08 B/s	40.01 B/s
05		4134	CHINANET-BACKBONE No.31,Jin-ro...		CN	2.79 MB	4.98 %	346.55 B/s	32.35 B/s
06		4230	Embratel		BR	2.89 MB	5.14 %	589.78 B/s	33.42 B/s
07		9848	GNGAS Enterprise Networks		KR	2.80 MB	4.98 %	438.09 B/s	32.38 B/s
08		9394	CRNET CHINA RAILWAY Internet(C...		CN	1.73 MB	3.07 %	529.24 B/s	19.98 B/s
09		3462	HINET Data Communication Busin...		TW	628.27 kB	1.12 %	344.44 B/s	7.27 B/s
10		12322	PROXAD Free SAS		FR	1.08 MB	1.93 %	193.35 B/s	12.55 B/s
11		Others				23.50 MB	41.86 %	903.87 B/s	271.98 B/s

top

Protocols

#	Key	Protocol	Total		Max	Avg
01		TCP	52.80 MB	94.05 %	2.52 kB/s	611.11 B/s
02		UDP	1.93 MB	3.44 %	77.65 B/s	22.37 B/s
03		ICMP	1.40 MB	2.50 %	25.78 B/s	16.25 B/s
04		Others	650.00 B	0.00 %	2.17 B/s	0.01 B/s

top

Destination TCP Ports

#	Key	Port	Name	Total		Max	Avg
01		22	SSH (Secure Shell)	37.36 MB	70.76 %	2.23 kB/s	432.40 B/s
02		445	Microsoft-DS Active Directory	8.42 MB	15.94 %	264.12 B/s	97.42 B/s
03		139	NETBIOS Session Service	3.92 MB	7.42 %	111.85 B/s	45.32 B/s
04		9988	Rbot/SpyBot	1.07 MB	2.03 %	257.83 B/s	12.38 B/s
05		2967	Symantec AV Corporate Edition	405.66 kB	0.77 %	175.54 B/s	4.70 B/s
06		1433	Microsoft SQL Server	179.03 kB	0.34 %	18.71 B/s	2.07 B/s
07		135	Microsoft RCP	152.16 kB	0.29 %	38.11 B/s	1.76 B/s
08		80	HTTP (Hypertext Transfer Protocol)	124.09 kB	0.24 %	77.47 B/s	1.44 B/s
09		4899	Radmin (remote administration tool)	115.93 kB	0.22 %	12.79 B/s	1.34 B/s
10		25	SMTP (Simple Mail Transfer Protocol)	105.44 kB	0.20 %	4.47 B/s	1.22 B/s
11		Others		955.95 kB	1.81 %	68.76 B/s	11.06 B/s

top

Destination UDP Ports

#	Key	Port	Name	Total		Max	Avg
01		5060	SIP (Session Initiation Protocol)	843.65 kB	43.64 %	61.96 B/s	9.76 B/s
02		137	NETBIOS Name Service	688.01 kB	35.59 %	20.22 B/s	7.96 B/s
03		1434	Microsoft SQL Monitor	225.05 kB	11.64 %	6.02 B/s	2.60 B/s
04		161	SNMP (Simple Network Management Protocol)	13.06 kB	0.68 %	0.66 B/s	0.15 B/s
05		12656	n/a	8.04 kB	0.42 %	0.94 B/s	0.09 B/s
06		6220	n/a	6.53 kB	0.34 %	0.56 B/s	0.08 B/s
07		55858	n/a	6.02 kB	0.31 %	1.77 B/s	0.07 B/s
08		52340	n/a	4.03 kB	0.21 %	0.75 B/s	0.05 B/s
09		33653	n/a	3.37 kB	0.17 %	0.68 B/s	0.04 B/s
10		500	ISAKMP	3.29 kB	0.17 %	3.45 B/s	0.04 B/s
11		Others		131.97 kB	6.83 %	5.83 B/s	1.53 B/s

top

Source Operating Systems (Windows)

#	Key	Operating System	Total		Max	Avg
01		Windows-XP-SP1/Windows-2000-SP4	6.75 MB	67.35 %	417.54 B/s	78.14 B/s
02		Windows-XP-SP1/Windows-2000-SP3	1.59 MB	15.87 %	229.76 B/s	18.41 B/s
03		Windows-XP-SP1/Windows-2000-SP2+	948.73 kB	9.46 %	162.56 B/s	10.98 B/s
04		Windows-2000/Windows-XP	281.94 kB	2.81 %	254.26 B/s	3.26 B/s
05		Windows-2000-RFC1323/Windows-XP-RFC1323	223.91 kB	2.23 %	24.01 B/s	2.59 B/s
06		Windows-98-noSack	123.24 kB	1.23 %	238.09 B/s	1.43 B/s
07		Windows-XP/Windows-2000-SP2	51.60 kB	0.51 %	63.27 B/s	0.60 B/s
08		Windows-98	33.80 kB	0.34 %	1.73 B/s	0.39 B/s
09		Windows-XP-cisco/Windows-2000-cisco	18.87 kB	0.19 %	14.25 B/s	0.22 B/s
10		Windows-98-lowTTL	211.50 B	0.00 %	0.32 B/s	0.00 B/s
11		other-Windows	450.50 B	0.00 %	0.32 B/s	0.01 B/s

top

Source Operating Systems (Other platforms)

#	Key	Operating System	Total		Max	Avg
01		Linux	35.29 MB	82.50 %	2.24 kB/s	408.43 B/s
02		unknown	7.10 MB	16.59 %	446.66 B/s	82.13 B/s
03		undefined	382.91 kB	0.90 %	25.95 B/s	4.43 B/s
04		Proxyblocker	2.36 kB	0.01 %	1.49 B/s	0.03 B/s
05		SunOS	2.09 kB	0.00 %	1.25 B/s	0.02 B/s
06		FreeBSD	1.95 kB	0.00 %	2.23 B/s	0.02 B/s
07		Solaris	1.46 kB	0.00 %	1.26 B/s	0.02 B/s
08		NMAP	688.71 B	0.00 %	1.91 B/s	0.01 B/s
09		NetBSD	405.87 B	0.00 %	0.30 B/s	0.00 B/s
10		SymbianOS-6048	44.00 B	0.00 %	0.15 B/s	0.00 B/s
11		Others	4.84 B	0.00 %	0.01 B/s	0.00 B/s

top

Observations:

Each image above contains a STACK AREA graphic, which means that each data set of the graphic is stacked on top of the previous one.
Lists of known TCP/UDP ports and associated service names can be found at the following documents:
- Port Numbers, from IANA.
- List of TCP and UDP port numbers, from The Wikipedia.
- Common Ports, from packetlife.net.
A list of known Country Codes can be found at IANA. The country code "XX" stands for network flows that could not be associated with any country code, for example, flows from private networks.