An overview of how to use Arkmon, CAIDA's web-based management system for Archipelago (Ark) monitors.

Matthew Luckie (CAIDA) presents early results of CAIDA's effort to adapt and integrate recently developed measurement and analysis capabilities to detect route leaks between R&E and commodity (non-R&E) networks. Such leaks, whether from accidental misconfiguration or malicious activity, threaten the availability and integrity of critical R&E network services. Recorded at the Internet2 Technology Exchange, December 2025.

Steven Wallace (Internet2) gives background on RPKI Route Origin Authorizations and demonstrates a tool, built with CAIDA, that assists network operators in planning their ROAs.

Matthew Luckie presents the Scamper Python module, a domain-specific language for actively probing destinations in the Internet in parallel at a specified packets-per-second rate, so that bulk measurement data can be collected in a timely fashion.

An introduction to AVOID, which secures 5G against hidden threats in the communications infrastructure. The automated system helps Department of Defense personnel secure 5G communications by avoiding nation-state adversaries and moving communications onto safe paths.

USENIX Security '23 talk on Access Denied: Assessing Physical Risks to Internet Access Networks (Marder, Zhang, Mok, Padmanabhan, Huffaker, Luckie, Dainotti, Claffy, Snoeren, Schulman). Regional access networks connect both wireline and mobile users to the Internet, yet long-standing economic and architectural constraints produce points of limited redundancy that leave them exposed to targeted physical attacks resulting in widespread outages.

Alexander Marder (CAIDA) presents How Do Clouds Use IXPs? at the Euro-IX Virtual Forum, December 2020, on how the large cloud providers peer at Internet exchange points around the world.

We will create a knowledge network that will improve the security and functioning of three key but inherently vulnerable systems that underpin all activity on the Internet: the addressing, routing, and naming systems. Lack of attention to security in early design decisions, persistent disagreement about the best path to improvement, and lowest-cost operational practices surrounding these three layers have allowed malicious actors to execute and scale harmful misbehavior including interception and disruption of traffic, denial of service and phishing attacks, and distribution and execution of malware.

• overview

Pedro Marcos presents AS Path Prepending: There is No Rose Without a Thorn (Marcos, Prehn, Leal, Dainotti, Feldmann, Barcellos) at NANOG, October 2020. AS path prepending (ASPP) inflates the AS path to steer inbound traffic; this longitudinal study finds ASPP widely deployed and slightly increasing despite public statements against it, with roughly 6k ASes originating prefixes whose prepends achieve no traffic-engineering goal. Active measurements show that ASPP's effectiveness depends on the AS's location and number of upstreams, and confirm its security implications.

This screencast provides a detailed overview on how to analyze Internet connectivity outages using IODA's Dashboard interface. IODA is short for Internet Outage Detection and Analysis and is a system being developed at CAIDA, a research center at UC San Diego. IODA's Dashboard is a publicly available web interface that allows you to learn about and investigate Internet outages. This screencast presents an overview of IODA, the data sources that IODA uses, and explores several Internet outage case studies, including large-scale outages caused by government-mandated shutdowns that affected Iran and Kashmir in 2019.

• www.caida.org/projects/ioda/

Raffaele Sommese presents MAnycast2 at ACM IMC 2020 (extended version). Anycast addressing has become a fundamental approach to improving the resilience and performance of Internet services, but its deployment model makes it impossible to infer from an address that it is anycast, and existing detection methods face accuracy challenges from routing and latency dynamics and scalability challenges from measurement load. MAnycast2 probes potential anycast destinations from a distributed platform of anycast vantage points, eliminating sensitivity to latency dynamics and greatly improving efficiency and scalability.

Cecilia Testart presents To Filter or not to Filter: Measuring the Benefits of Registering in the RPKI Today (Testart, Richter, King, Dainotti, Clark) at PAM 2020 (Session 1, Presentation 3).

Adnan Ahmed presents FlowTrace: A Framework for Active Bandwidth Measurements using In-band Packet Trains (Ahmed, Mok, Shafiq) at PAM 2020 (Session 2, Presentation 3).

Roderick Fanou presents Unintended consequences: Effects of submarine cable deployment on Internet routing (Fanou, Huffaker, Mok, Claffy), the PAM 2020 Best Paper (Session 3, Presentation 2). The work uses RIPE Atlas and CAIDA Ark traceroute and BGP data to study the impact of a submarine cable launch connecting Africa to South America.

Raffaele Sommese presents When parents and children disagree: Diving into DNS delegation inconsistency (Sommese, Moura, Jonker, van Rijswijk-Deij, Dainotti, Claffy, Sperotto) at PAM 2020 (Session 4, Presentation 2).

This screencast teaches you how to use IODA's Explorer interface. IODA is short for Internet Outage Detection and Analysis and is developed at CAIDA, a research center at UC San Diego. IODA's Explorer allows you to perform power analyses of Internet outages. This screencast presents the components of the Explorer interface and goes on to explain how to manipulate various time series to perform in-depth analyses of Internet outages detected by IODA.

• www.caida.org/projects/ioda/

Net Neutrality has become a bit of a political football. We don't have even close to enough data to truly litigate the net neutrality debate in an equitable way. We don't know enough. You need measurement." In this series of short clips, KC Claffy, founder and director of the Center for Applied Internet Data Analysis (CAIDA) at SDSC, brings us up to speed on some of the key issues surrounding the Net Neutrality debate. Watch the video "The Net Neutrality Debate", part of a series on Net Neutrality and Why We Need to Measure the Internet.

This screencast teaches you how to use IODA's Dashboard. IODA is short for Internet Outage Detection and Analysis and is developed at CAIDA, a research center at UC San Diego. IODA's Dashboard allows you to learn about and investigate Internet outages. This screencast will present the data sources that IODA uses, explain the components of its user interface, and discuss how to use IODA effectively.

• www.caida.org/projects/ioda/

Recording of the ANRW 2018 session at IETF 102 (Montreal, 16 July 2018) in which Alberto Dainotti presented ARTEMIS: Neutralizing BGP Hijacking within a Minute. The recording covers the whole ANRW session; the ARTEMIS talk is one presentation within it.

A short San Diego Supercomputer Center profile in which kc claffy, founder and director of CAIDA, describes the scale of today's Internet - roughly half a million independently routable units and some 60,000 autonomous networks - argues that security is its biggest open issue, and makes the case that its future depends on accurate measurement from multiple sources of data.

Henya is CAIDA's large-scale Internet topology query system which provides remote search of traceroute data without requiring data downloads. Henya includes built-in analyses and visualizations for commonly occuring needs, and is intended to be responsive enough for interactive data exploration.

Over the past several months, CAIDA, in collaboration with Matthew Luckie at the University of Waikato, has upgraded Rob Beverly's original spoofing measurement system, developing new client tools for measuring IPv4 and IPv6 spoofing capabilities, along with services that provide reporting and allow users to opt-in or out of sharing the data publicly. Watch the video "What is IP Spoofing?" for an overview of what IP spoofing is and how you can install Spoofer and help.

• www.caida.org/projects/spoofer/

Vasileios Giotsas (CAIDA) presents The Remote Peering Jedi at RIPE 73 (Madrid, October 2016): a methodology and tool for detecting remote peering at Internet exchange points. Also available as the official RIPE 73 webcast.

• ripe73.ripe.net/archives/video/1455/

Vasileios Giotsas (CAIDA) presents Periscope, CAIDA's system for standardizing and orchestrating looking-glass querying, at NANOG 68 (Dallas, October 2016).

Recording of the NANOG 68 Security Track (Dallas, October 2016). kc claffy's talk Software Systems for Surveying Spoofing Susceptibility, on the Spoofer project's measurement of source address validation deployment, begins at 33:30.

Recording of the NANOG 66 Lightning Talks session (San Diego, February 2016), which includes Alberto Dainotti's report 48hrs after the 1st BGP Hackathon.

Recording of the NANOG 66 Research and Education Track (San Diego, February 2016), featuring talks on BGP measurement and analysis and on DDoS defense. Alberto Dainotti's talk BGPStream: a framework for historical analysis and real-time monitoring of BGP data begins at 26:57.

Recording of the NANOG 66 keynote on Internet measurement (San Diego, February 2016). David Clark (MIT) and kc claffy (CAIDA) give historical and current perspective on Internet measurement research and evolving industry structure, with Geoff Huston (APNIC) as respondent.

LISA Conversations (USENIX, April 2016): Tom Limoncelli and Lee Damon talk with kc claffy and Lixia Zhang about kc's LISA15 talk A Brief History of a Future Internet: the Named Data Networking Architecture. The recording of the original LISA15 talk is linked as well.

• 2459d6dc103cb5933875-c0245c5c937c5dedcca3f1764ecc9b2f.ssl.cf2.rackcdn.com/lisa15/claffy.mp4

Recording of the IETF 94 Operations, Administration, and Technical Plenary (Yokohama, 4 November 2015). Alberto Dainotti's talk Measuring and Monitoring BGP begins at 1:22:00.

Recording of the opening session of the Silicon Flatirons 2015 Digital Broadband Migration conference: welcome, then the panel Mapping the Technological Frontier and the Sources of Innovation with kc claffy (CAIDA), David Clark (MIT), Ashkan Soltani (FTC) and Jack Waters (Level 3), moderated by Paul Ohm. kc claffy's remarks begin at 10:52.

To visualize large-scale Internet events, such as a large region losing connectivity, or a stealth probe of the entire IPv4 address space, we coordinated views to study the temporal evolution of an event along different dimensions, including geographic spread, topological (address space) coverage, and traffic impact. In early 2011, there was a government-mandated Internet blackout in Egypt, which isolated the country from the rest of the Internet for more than five days. The view pictured combines a geographical representation of Egypt region along with animations of the source addresses observed during the event, both at a global level, and from the 41.0.0.0/8 network delegated to AfriNIC.

• catalog.caida.org/details/paper/2014_coordinated_view_internet_events/
• www.youtube.com/watch?v=4Khc0XgvdbM
• www.youtube.com/watch?v=YWXgWfNxR9Q

The sipscan composite animation combines the world map animation, standard byte ordered target progression animation, and the reversed byte order animation into a single, synchronized video. This allows an immediate comparison between the geographical dynamics of the bots and the progression of the IP addresses across the duration of the scan.

A narrated visualization of a stealth botnet-coordinated scan of the entire IPv4 address space, targeting critical voice communications infrastructure. Multiple coordinated views dissect the temporal evolution of the event along geographic spread, topological (address space) coverage, and traffic impact, revealing the reverse-byte incrementing behavior of the scan and the distinct phases orchestrated by the botmaster.

The sipscan coordinated view animation combines the world map animation, standard byte ordered target progression animation, and the reversed byte order animation into a single, synchronized video. This allows an immediate comparison between the geographical dynamics of the sources and the progression of the target addresses across the duration of the scan.

• .mp4 (40.3 MB)
• screenshot

The animation of the sipscan target progression in reversed byte order represents the progression over time of the IP addresses targeted by the sipscan. The darknet address space is represented as a Hilbert curve of order 12 in which the order of the three least significant bytes of each address is reversed before mapping it into the curve. Highlighted pixels correspond to IP addresses that have been probed up to that time (5 Feb 2011 11:47 GMT, in this frame). The animation proves the reverse-byte order progression is rigorously followed by the bots during the entire 12 days, independent of the varying rate of the sipscan.

• .mp4 (21.0 MB)
• screenshot

The animation of the sipscan target progression in standard byte order represents the progression over time of the actual IP addresses targeted by the sipscan. The darknet address space is represented as a Hilbert curve of order 12. Drawing the Hilbert curve using IP addresses sequenced in their natural byte order does not reveal a particular pattern in the target progression, showing the square uniformly filling across the 12 days of the scan.

• .mp4 (40.1 MB)
• screenshot

The Sipscan World Map animation shows, with 5:20-minutes of data represented per frame, circles at the geographical coordinates of source hosts (bots) with size proportional to the number of hosts geolocated to those coordinates, and color to the number of packets sent. The animation depicts the spatial and temporal dynamics of the scan.

• .mp4 (35.8 MB)
• screenshot

Lo-fi recording of kc claffy's presentation at the UCSD DANCES seminar (November 2011) on the analysis of country-wide Internet outages caused by censorship, combining BGP, traceroute and darknet data. The talk begins at 0:52 and questions at 33:58.

Recording of Dmitri Krioukov's talk Robustness of Targeted Transport in Complex Networks at the Robustness of Complex Networks workshop, TU Delft, November 2010. Served by TU Delft's Mediasite player; plays without a login (checked 2026-08-28).

A visualization of the characteristics of IPv4 "whois" data from the five Regional Internet Registries (RIRs).

The DNS workload animated maps show the number of queries and clients seen by one of the .CL nameservers in Chile and its hourly variation along two days of traces beginning on July 3rd 2007 at 21:00 (UTC). The animation provides a view of the world map and colors countries based on the load that each country originates. The use of a terminator to show the sun's shadow helps depict potential diurnal patterns in the displayed data.

An animated explanation of denial-of-service attacks and of backscatter analysis, the technique CAIDA used to infer worldwide DoS activity from the unsolicited responses that victims send back to spoofed source addresses observed at the UCSD Network Telescope. Copyright 2001 Regents of the University of California.

BGP animations shown in kc claffy's presentation at the December 1997 IETF meeting. The animation has no audio track. The recording is a 62 MB MPEG-1 file served from caida.org; download it to play. No streaming copy exists (checked 2026-08-28).

• The Nyxem Email Virus: Analysis and Inferences

• Analysis of the Witty Worm
• The Spread of the Witty Worm
• Cuttlefish Example: Witty Worm Infected Hosts

• (See "Witty Worm (world)" above)

• CAIDA Analysis of Code-Red
• The Spread of the Code-Red Worm (CRv2)
• Static image of the Code-Red Worm animation
• CodeRed Worm Infections in 24.0.0.0/8 on July 19, 2001
• Code-Red: a case study

The Egypt outage coordinated view animation combines a geographical representation of Egypt region along with animations of the source addresses observed during the event, both at a global level, and from the 41.0.0.0/8 network delegated to AfriNIC. (Egypt area map © OpenStreetMap contributors, CC BY-SA)

• Related paper: A Coordinated View of the Temporal Evolution of Large-scale Internet Events

The full source address space animation shows which sources sent packets to the UCSD Network Telescope before, during, and after the Egypt Internet Blackout. Address ranges which have been identified to belong to Egyptian organizations are highlighted in a dark blue color.

The zoomed source address space animation shows which sources within the 41.0.0.0/8 network - which has been delegated to AfriNIC - sent packets to the UCSD Network Telescope before, during, and after the Egypt Internet Blackout. Address ranges within the /8 network which have been identified to belong to Egyptian organizations are highlighted in a dark blue color.

• Animated Maps of Two Days of DNS Workload for the .CL Chilean ccTLD

• Animated Maps of Two Days of DNS Workload for the .CL Chilean ccTLD

• Inferring Internet Denial-of-Service Activity
• Network Telescopes Overview: What is a "Network Telescope"?
• UCSD Network Telescope -- The Backscatter-TOCS Dataset
• Worldwide Detection of Denial of Service (DoS) Attacks

• AS Core: Visualizing Internet Topology at a Macroscopic Scale

• CAIDA's skitter tool

• CAIDA's Mapnet tool