The contents of this legacy page are no longer maintained nor supported, and are made available only for historical purposes.

Cuttlefish Example: Witty Worm Infected Hosts

On Friday March 19, 2004 at approximately 8:45pm PST, the Witty Internet Worm began to spread, targeting a buffer overflow vulnerability in several Internet Security Systems (ISS) products. To create this animation with Cuttlefish, we used Digital Envoy's NetAcuity server for world wide mapping of IPv4 addresses to geographic locations of data collected with the UCSD Network telescope .


This animated example displays the number of infected hosts and their geographic location on the world map with a sweeping terminator to highlight the border between night and day. The animation shows the incredible rate at which the Witty Internet Worm infected hosts, reaching its peak after only 45 minutes. The animation also shows the effects of Witty's destructive payload, in combination with efforts to filter Witty traffic and patch infected machines, leading to the rapid drop in the number of infected hosts over the five day period of data. 12 hours after the worm began to spread, half of the Witty hosts were rendered inactive. The histogram in the upper right corner displays the total number of infected hosts over the five day period of collection. Note that the difference between UTC and PST time is -8 hours. The legend directly below the histogram displays the color coding of the data points. The colored data points represent the number of hosts throughout the world infected by the Witty Worm.

Note: The gap around 2:00 UTC on March 22nd is due to a problem with data collection and does not reflect the actual virus infection rate.

For more information on the Witty Worm, see:

The Configuration and Data File

Each of the objects and the data in the animation below are defined in the configuration file unique to this example. This particular example includes the default global map, the histogram, the color legend, and 123 frames containing 229 data points with 14,298 associated values spanning the five day period.

In this example, to increase the contrast between night and day, we changed the default settings for background, foreground, night, and day colors in the configuration file.

For details on the objects and attributes recognized by Cuttlefish, see the README.config file.

Cooperative Association for Internet Data Analysis WIDE Project University of California at San Diego San Diego Supercomputer Center Cisco Systems National Science Foundation Defense Advanced Research Projects Agency U.S. Department of Homeland Security

Related Objects

See to explore related objects to this document in the CAIDA Resource Catalog.
Last Modified