Methodology

Blackhole monitoring
Collect traffic to a globally announced, unused /8 network
Provided by a research partner
Roughly 1/256 of entire Internet address space
UUNet BlackHole Route Server, CenterTrack
IBGP off-ramping of traffic for inspection
CAIDA DDoS study
2 weeks of backscatter
CAIDA CodeRed analysis
16.5 hours of packet headers only