that adapt automatically to the traffic as it changes. Trafficvolume patterns can be watched online and compared between the differentiatedclusters. These traffic groups are presented visually through a tree: Packetsthat are found to be internally dissimilar are clustered separately, so thatusers immediately observe that they are different in nature. Also, eachcluster's position in the tree contains a wealth of context about how thetraffic for that cluster is similar and different from the rest of thenetwork's traffic. Volume of traffic through each cluster is displayed in thetree in near real-time, allowing administrators to analyze traffic patterns asthey emerge. High level tools can often show that something is wrong. Low level toolsgive tremendous detail, but often are too slow or too information-rich to beused Clustering is a form of filtering that allows one to focus on relevantbehavior. NetADHICT allows the integration of high and low level tools whileproviding enough information to allow administrators to move smoothly fromhigh to low. The NetADHICT interface is designed to facilitate such multi-levelexploration. It is built around the cluster tree approach to network volumevisualization. Each cluster of traffic within the tree is identified by atraditional classifier and colored appropriately. (The traditional classifieris built around EtherType, IP protocol, and IP port.) This coloring of theclusters, along with their position in the tree, highlights traffic that iscontextually different but using the same ports. It provides an excellentstarting point for delving further into different classes of traffic in thenetwork and highlights classes that would have remained completely hiddenotherwise. In this fashion NetADHICT is a tool for enhancing networkawareness. Hierarchical Clustering with (p,n)-gramsNetADHICT is centered around a novel clustering algorithm that recursivelysplits the set of observed packets into smaller and smaller groups. We callour algorithm Approximate Divisive HIerarchical Clustering (ADHIC), the rootof NETwork ADHIC Tool (NetADHICT). This algorithm is classified as a type ofmachine learning algorithm broadly known as divisive hierarchical clustering[5], but ours is substantially different than other general purpose or networkspecific clustering algorithms. We give an overview of ADHIC below; for moredetails, please see Hijazi [10]. The feature we use to split groups of packets is called a (p,n)-gram.(p,n)-grams are used to denote substrings at fixed offsets within packets.The p is the offset and n is the length of the substring. For example, the(p,n)-gram (8, 0xdc3b) denotes the 2 byte hexadecimal substring 0xdc3b 8bytes into the packet (these are the middle bytes of the source MAC address inthe Ethernet frame). Divisive hierarchical clusterers form decision trees. The tree isconstructed using the split and merge operations. When theaverage bandwidth of a terminal cluster (leaf) exceeds a configurablethreshold over a certain time window, the cluster is split into two clusters.The existing node becomes an internal decision node and two new terminalclusters are formed. A (p,n)-gram is found by examining the packet cache, abuffer that stores a few percent of recently received packets. (p,n)-gramfrequencies are calculated for packets assigned to the terminal cluster inquestion, and a (p,n)-gram is chosen which matches roughly half of them.Conversely, if a node averages less than a set bandwidth limit, it is deletedand its parent becomes a leaf node.