Telescope traces

Traffic visualization

Using the BSOD tool we visualize the telescope traffic. On the left side of the screen are shown the IP addresses that send packets to the telescope (IP source), while the telescope network addresses appear on the right side (IP destination). Each IP address is mapped to a unique point on the planes and the colour of the particles that move from the source to the destination depends on protocol (as shown in the legends).
In the following Figures we apply filters for visualizing the differences between different traffic categories.

Figure 1. All traffic, excluding the port 445	Figure 2. All traffic to the port 445
Figure 3. HTTP traffic	Figure 4. Encrypted (SSH/SSL) traffic
Figure 5. ICMP traffic	Figure 6. UDP traffic

In the Figure 1 we can observe the traffic that goes to the telescope excluding the packets direct to the tcp port 445. While in Figure 2 we can observe the high amount of packet direct only to the port 445. The traffic to the port 445, during the observation interval, is originated from different IP sources, while in the Figure 1 a large part of packets comes from a limited number of hosts, as we can see also in the remaining Figures. Only the packets direct to SSH/SSL ports show in these snapshots a similar nature to the traffic to the port 445.