Slammer/Sapphire Trace Data

This trace data set is the collected daily samples from all active NLANR PMA monitors before and during the outbreak of the Sapphire/Slammer worm in January 2003.

The data available here covers the two days of January 25th and January 26th.

Data is available at the following locations:

• ftp://pma.nlanr.net/traces/long/slam/
• http://pma.nlanr.net/Traces/Traces/long/slam/

The following papers are, in part, based on this data set:

Nick Duffield, Carsten Lund, Mikkel Thorup: Estimating Flow Distributions from Sampled Flow Statistics, Proceedings of SIGCOMM 2003, August 25th - 29th, 2003, Karlsruhe, Germany.

Abhishek Kumar, Minho Sung, Jun (Jim) Xu, Jia Wang: Data Streaming Algorithms for Efficient and Accurate Estimation of Flow Size Distribution ACM SIGMETRICS / IFIP WG 7.3 Performance 2004, New York, June 2004. Talk. Best Student Paper Award.

The following web page provides further references:

http://www.caida.org/analysis/security/sapphire/

Top   last modified: 26 Apr 2005   Jörg Micheel   Comments, questions are welcome:   Feedback