Forensics 3. How we noticed there was a problem

• Campus firewall suddenly struggling under load

• But during Summer vacation, so not many students around, and lots of staff away on holiday

• Log file analysis shows thousands of simultaneous connection attempts to SGI workstations in two departments

• Packets appear to be coming in from thousands of different hosts

• Able to stablise firewall, but choke point moves to East Midlands Metropolitan Area Network instead