## 4 DPI Applied to Honeynet Traffic and Attacks
### Layer 3 Header Analysis
#### 4.2.1 Classification of Traffic by Its Geoinformation  
Analysis of the header of the third layer of the packets shows that China is the most representative source of the attacks to the Honeynet. The fifteen IP addresses that most attacked the network are all from this country and originated from the cities Shenzhen, Nanchang and Nanjing. Figure 6 shows the relative contribution of the most frequent countries and IP address for the total traffic, along with the ports to where each IP sent its packets. Such analysis provided information about the service attack type and, although the majority of the analyzed packets where directed to port 22, the most targeted port was 23, which suggests that a greater amount of traffic to port 23 is distributed in a higher number of less frequent IP addresses, while traffic to port 22 is concentrated in the most frequent IP addresses (more details about analysis of these ports are provided in Section 4.3.1). Figure 5: Numbers of packets sent to the Honeynet per day. During the analysis of layer 3, it became evident the similarity of the IP addresses from the city Shenzhen. This is a strong indication that the hosts using those IP addresses probably belong to the same subnetwork and, therefore, it either corresponds to a network with several infected devices (i.e., as part of a botnet) or to a network setup for malicious purposes. Table 6 shows these findings in the collected data. Like in the previous months ([70]), China still corresponds to most of the traffic, although the percentage of packets from this country has lowered. On the other hand, countries such as Taiwan, Turkey and Colombia had attacks arising and became responsible for a greater percentage, while the Netherlands and Germany no longer appeared as the top 15 countries based on the historical data. A total of 163 different source countries appeared as the origin of the attacks directed to the Honeynet. Regarding information provided in Table 6 and, in accordance with Figure 6b, the 15 IP addresses that most attacked the Honeynet correspond to the source country being China from three different cities. Regarding the historical analysis of the Honeynet, it shows opposed information when compared to the previous months ([70]), where several countries appeared as the most frequent IP source countries \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Source Country** & **Number of Packets** & **IP Address (City)** & **Number of Packets** \\ \hline China & 4,027,465 & 11x.3x.116.7 (_Shenzhen_) & 590,553 \\ Vietnam & 1,122,658 & 11x.3x.116.26 (_Shenzhen_) & 467,034 \\ Brazil & 836,715 & 11x.3x.116.27 (_Shenzhen_) & 261,392 \\ Taiwan & 596,842 & 11x.3x.116.8 (_Shenzhen_) & 165 551 \\ Republic of Korea & 521,197 & 11x.3x.116.29 (_Shenzhen_) & 133,976 \\ India & 439,838 & 5x.12x.199.181 (_Nanjing_) & 132,058 \\ Turkey & 428,563 & 11x.3x.116.37 (_Shenzhen_) & 110,694 \\ Russia & 417,440 & 11x.3x.116.4 (_Shenzhen_) & 106,413 \\ Ukraine & 358,706 & 5x.21x.199.218 (_Nanjing_) & 94,049 \\ United States & 345,360 & 18x.10x.67.248 (_Nanchang_) & 70,285 \\ Colombia & 225,551 & 21x.6x.30.4 (_Nanchang_) & 70,285 \\ Romania & 197,977 & 21x.6x.30.86 (_Nanchang_) & 66,535 \\ Argentina & 196,200 & 11x.3x.116.28 (_Shenzhen_) & 58,361 \\ Mexico & 187,786 & 11x.3x.116.20 (_Shenzhen_) & 54,130 \\ Poland & 118,792 & 11x.3x.116.21 (_Shenzhen_) & 52,454 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The fifteen countries and IP addresses that most attacked the Honeynet. Figure 6: Classification of traffic according to its source, from August 2016 to December 2016. (**a**) indicates source country of the attacks; (**b**) indicates IP source, in the inner chart, and their respective service attacked type represented in the outer chart. with little difference among the number of packets. Based on the newer data collected and analyzed, this indicates that the Honeynet now has more attention from countries such as China, Vietnam and Brazil, which together correspond to almost 50% of the traffic.