that behavior, acting asa bridge from higher level tools to the lower level ones. Fromexperiments we believe that NetADHICT can assist in the identificationof flash crowds, rapidly propagating worms, and P2P applications. Introduction Network administrators are regularly confounded by the behavior of thenetworks they manage. Part of this confusion is a function of the rapidinnovation in applications and protocols; it also arises from simple humanunpredictability. Much of the blame for the mystery of computer networks,though, can be laid at the feet of our tools: we simply do not have the meansfor truly understanding what is happening in our networks [11]. To be sure, we have numerous tools for monitoring networks. Packet volumemonitors can alert administrators to gross changes in network behavior. Flowreconstruction and protocol dissectors can reveal the behavior of individualconnections. Signature scanners can identify specific security problems, andanomaly detectors can tell us that something is "different." As we discussin the Related Work section, these tools, while useful, are not sufficient forus to achieve network awareness. One key piece that is missing is a way to view traffic at the "right"level of abstraction. For example, when dealing with a surge in web traffic,we need more detail than "80% of your traffic is HTTP"; however, analyzingthe patterns in 50,000 HTTP connections is sure to induce informationoverload. In order to address this shortcoming, we need tools that canautomatically extract multiple human-comprehendable abstractions of networkbehavior (e.g., most of connections have slashdot in the HTTP referrer field).By understanding the structure of the observed abstractions and by seeing howfuture traffic fits into them, an administrator can quickly come to understandhow network behavior changes at a level of granularity that facilitatesboth holistic understanding and appropriate response. We have developed a tool called NetADHICT (pronounced "net-addict") for extracting and visualizing context-dependent abstractions ofnetwork behavior. NetADHICT hierarchically decomposes network traffic: forexample, observed packets are first divided into IP and non-IP groups, IPpackets are then split into TCP and non-TCP, and so on. What is notable aboutNetADHICT, though, is that its decomposition is automatically derived fromobserved traffic; in other words, it learns an appropriate context-dependenthierarchical classification scheme automatically with no built-inknowledge of packet or protocol structure. NetADHICT is able to perform this feat through the use of a novelclustering method we refer to as "Approximate Divisive HierarchicalClustering (ADHIC)." When applied to traces of captured traffic, NetADHICTgenerates hierarchical clusters that closely correspond to the kind ofsemantically meaningful abstractions that are normally used to describenetwork behavior [10]. Remarkably, NetADHICT often aggregates packets withoutthe use of ports or IP addresses; it also groups packets across multiple flowswhen there is significant commonality. Although we have not attempted to optimize NetADHICT, it is designed to beextremely efficient, allowing use of the tool at wire speed. We havebenchmarked NetADHICT at 245 Mb/s. NetADHICT can achieve this speed because itclassifies packets using sets of fixed-length strings located at fixed offsetswithin packets. We refer to these patterns as (p,n)- grams. Of course, fancy algorithms are not enough to make a useful tool forobserving networks; we also need appropriate interfaces for visualizing andinteracting with observed traffic. To that end, this