4 ms·
Presumably, Windstream is logging customer traffic as a matter of course. It might just be metadata (NetFlow/sFlow/IPFIX/etc), but one way or the other the onl
by luma 2y ago
Presumably, Windstream is logging customer traffic as a matter of course. It might just be metadata (NetFlow/sFlow/IPFIX/etc), but one way or the other the only way they have this information is if they are recording and retaining it.
Hopefully this is made clear in Windstream's contract terms.
- londons_explore 2y agoThese aren't likely 'top flows', since the C&C data will probably only be a few kilobytes. So to capture this, you at a minimum need to be logging every TCP connection's SRC IP and DST IP. And they seem pretty confident in their worldwide map and fairly exact counts, so I would guess they must have probes covering most of the world doing this monitoring, and it likely isn't just 1-in-a-million sampling either...
- luma 2y agoFor whatever it's worth, what you describe above is specifically what IPFIX/NetFlow etc does. Not full-take, just metadata for each flow such as the time, src/dst ip/port, tcp sequence #, octets sent, etc. This is common in datacenters for traffic and flow analysis for troubleshooting, capacity planning, and the occasional incident response. More details: https://en.wikipedia.org/wiki/IP_Flow_Information_Export https://en.wikipedia.org/wiki/IP_Flow_Information_Export