of a propagating worm. Worms are asubcase of the flash crowd because they involve a large increase in trafficover protocols that are already used. The benefits of NetADHICT are similar tothose during a "slashdotting." If a particular set of addresses isresponsible, NetADHICT may allow the administrator to discover it by knowingthe (p,n)-gram offsets. Similarly, NetADHICT might also create new clustersspecific to worm traffic. Inspection of the (p,n)-gram equation might allowthe administrator to construct a signature for the worm, which could then beapplied to a firewall or an intrusion prevention system. Even if the(p,n)-gram equations could not be used for this purpose, thepcap file NetADHICT provides would be useful in signatureconstruction. We believe NetADHICT would be useful in many additional scenarios. These,however, hopefully provide a useful introduction in how the tool could beused. NetADHICT, as a complement to existing tools and systems, can allow anadministrator to quickly ascertain the state of his network and investigateany anomalous behavior as it occurs. Discussion While our experience with NetADHICT has convinced us that it is a usefultool for network administrators, we have also experienced its limitations.First and foremost is ADHIC's inability to classify packets. ADHIC is aclustering algorithm that does not rely on prior knowledge to segregatetraffic into clusters - therefore the clusters may not always have thesemantic splits that administrators may prefer. ADHIC's use of (p,n)-gramsalso is a source of problems. Some interesting semantic splits do not lendthemselves to using (p,n)-grams. The reason for this is that someidentifiers are not at constant offsets from the beginning of the packet.These weaknesses are mitigated by NetADHICT's incorporation of a traditionalclassifier, its ability to work with other network analysis tools usingpcap files, and the administrator's ability to label thecluster tree. The extent to which these inherent limitations will affect NetADHICT'susefulness is not clear. To this point we have not investigated NetADHICT'sbehavior beyond our own laboratory's network. We have determined thatNetADHICT can often segregate encrypted and multimedia traffic, by only usingtheir packet headers. If traffic moves to more evasive strategies such asoverloading common protocol ports, playing with the other header fields, andusing encrypted payloads, NetADHICT may be less able to discover patterns innetwork traffic. Evaluation of NetADHICT is difficult because it uses full packet payloads.Using full payloads introduces privacy concerns. This has not been an issuefor our internal lab, but we could not investigate NetADHICT's behavior onother, larger, networks because of our inability to correlate the generatedtrees with the raw pcap traces. Our limited ability to evaluate NetADHICT has helped motivate us torelease this tool. We can advance our research and improve it with moreadministrators testing NetADHICT on their own networks. The tool continues to improve, even without an external user base. We areimproving the integrated traditional classifier. In addition, we would like togive users the ability to control the tree through manipulating or lockingnodes as it grows. This may improve an administrator's ability to find,label, and track semantic classes of traffic. We are also investigatingdifferent user interfaces and visualizations of the data. Finally, we are working on moving the cluster and sampling portions ofNetADHICT into the Linux kernel.