Paradiso [8]) is the only truly capable browser forrunning NetADHICT. Firefox 2 is functional but too slow for real use. InternetExplorer 7 and Konqueror 3 lack the SVG support required, and the latest Operarelease (version 9.23) contains critical bugs in regard to its SVG supportthat prevent NetADHICT from functioning. While this variable performance iscurrently problematic, better SVG support is on the short-term developmentroadmap for most browsers; thus, we believe the browser compatibility issuewill soon cease to be a significant problem for NetADHICT. Usage Scenarios We now move from describing the tool itself to how a network administratorwould use the tool in several common situations. These situations are:checking normal network traffic,analyzing a flash crowd,recognizing special network usages or activities such as local P2P traffic,andidentifying and isolating a propagating worm.In earlier papers [10, 15], we described several experiments which we usedto evaluate the ADHIC algorithm. The following descriptions are not of actualexperiments, but we draw upon our research experience to describe how onecould use the tool in a small network context. While we believe these usagescenarios should generalize to larger networks, further testing is required. Checking Normal Network Traffic The first usage scenario is network surveillance under normal conditions.The network administrator begins a session by examining the current tree, asin Figure 2. An administrator knows what a normal-condition tree and flowvalues (the size of the pie charts) look like and can immediately spotanomalous behavior. If he sees unusual behavior in some part of the tree hecan magnify the subtree and examine its volume pie charts to see what iswrong. Alternatively, he can view the tree for specific past time periods. Byviewing the series of trees from the immediate past he can see how the treedeveloped to its current form. We have found this "movie" to be very usefulin understanding network behavior. It is analogous to animated radar maps -but instead it shows network weather. As we will discuss in the other usage scenarios, anomalous traffic flowswill lead to easily identifiable changes in the tree structure or the volumepie charts. However, if the tree visualization is not enough to identify theproblem he can hover the cursor over a node to see the statistical networktraffic volume summary as in Figure 6.Figure 6: Details of a node in the tree. An administrator has another option if he needs more information than thetwo visualizations provide. He can shift-click on any number of clusters torequest that NetADHICT record all future packets assigned to those clusters.These packets can then be downloaded as a pcap file into atool like WireShark [3]. This allows the administrator to use any analysistool he likes that reads pcap files while first usingNetADHICT to eliminate the vast majority of uninteresting traffic. Analyzing a Flash Crowd Now let us consider what might happen if a particular page on a websitewas hit by a flash crowd, or "slashdotted." A traditional network tool wouldnotify the administrator that total traffic volume is up, when the surgeoccurred, and would probably identify, using port numbers, that HTTP is theculprit. The administrator might then turn to the web server logs for furtherinformation. Like