DS-0693

DDOS_Chargen_2016

Dataset

Merit Network, Inc.

Merit Network, Inc.

11/25/2016

11/26/2016

39 (lowest rank is 57)

Traffic Flow Data

Quasi-Restricted

true

Data Use Terms

Short Description
Internet traffic data containing a DDoS attack based on UDP Chargen protocol

Long Description
This is a real-world DDoS attack captured at Merit's border router in SFPOP. It's a reflection and amplification Distributed Denial of Service attack (DDoS) that is based on the CHARGEN protocol (over UDP). Data are organized into 4 folders, namely WSUa, WSUb, WSUc and WSUd (all folders contain data from the same site; due to traffic load balancing, we have 4 collection folders). The attack starts around 11:59am (Eastern Timezone) and hits destination IP 35.7.72.0 (all our IPs are anonymized by zeroing the last 11 bits). Data format: flow-tools

67.1GB

true

false

2016, merit, network, ddos, chargen, ddos_chargen_2016, 693, anonymized, merit network, inc., attack, traffic, based, protocol, udp, folders, flow, distributed, format, bits, real, ips, hits, amplification, balancing, site, service, zeroing, organized, reflection, eastern, captured, traffic flow data, timezone, 59am, destination, tools, router, load, sfpop, wsud, starts, wsuc, wsub, wsua, border, denial