<article>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#article10_01_23_2327204</id>
	<title>Crazy Firewall Log Activity &mdash; What Does It Mean?</title>
	<author>kdawson</author>
	<datestamp>1264256640000</datestamp>
	<htmltext>arkowitz writes <i>"I happened to have access to five days worth of firewall logs from a US state government agency. I wrote a parser to grab unique IPs out, and sent several million of them to a company called <a href="http://quova.com/">Quova</a>, who gave me back full location info on every 40th one. I then used <a href="http://www.greenphosphor.com/">Green Phosphor's Glasshouse</a> visualization tool to have a look at the count of inbound packets, grouped by country of origin and hour. And it's <a href="http://www.youtube.com/watch?v=sB2jEhDZyBk">freaking crazy looking</a>. So I made the video of it and I'm asking the Slashdot community: What the heck is going on?"</i></htmltext>
<tokenext>arkowitz writes " I happened to have access to five days worth of firewall logs from a US state government agency .
I wrote a parser to grab unique IPs out , and sent several million of them to a company called Quova , who gave me back full location info on every 40th one .
I then used Green Phosphor 's Glasshouse visualization tool to have a look at the count of inbound packets , grouped by country of origin and hour .
And it 's freaking crazy looking .
So I made the video of it and I 'm asking the Slashdot community : What the heck is going on ?
"</tokentext>
<sentencetext>arkowitz writes "I happened to have access to five days worth of firewall logs from a US state government agency.
I wrote a parser to grab unique IPs out, and sent several million of them to a company called Quova, who gave me back full location info on every 40th one.
I then used Green Phosphor's Glasshouse visualization tool to have a look at the count of inbound packets, grouped by country of origin and hour.
And it's freaking crazy looking.
So I made the video of it and I'm asking the Slashdot community: What the heck is going on?
"</sentencetext>
</article>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875152</id>
	<title>I know what it is</title>
	<author>Anonymous</author>
	<datestamp>1264263360000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext>An ad.  Same voice on this video as on the demo for the software company who made the 3D charting.  3D charting, whoop-de-fucking-do.</htmltext>
<tokenext>An ad .
Same voice on this video as on the demo for the software company who made the 3D charting .
3D charting , whoop-de-fucking-do .</tokentext>
<sentencetext>An ad.
Same voice on this video as on the demo for the software company who made the 3D charting.
3D charting, whoop-de-fucking-do.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876166</id>
	<title>Re:Naughty Country IP list</title>
	<author>osu-neko</author>
	<datestamp>1264273080000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely?</p></div><p>If I block all Canadian IP addresses, will I no longer have to view comments from clueless server admins like yourself?</p></div>
	</htmltext>
<tokenext>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely ? If I block all Canadian IP addresses , will I no longer have to view comments from clueless server admins like yourself ?</tokentext>
<sentencetext>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely?If I block all Canadian IP addresses, will I no longer have to view comments from clueless server admins like yourself?
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875274</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877172</id>
	<title>Re:Obviousness?</title>
	<author>tenco</author>
	<datestamp>1264333320000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>And when did the first stripe occur, say, 0600 Monday local time?</p> </div><p>My first thought. I bet the first day of this 5-day-period is saturday.</p></div>
	</htmltext>
<tokenext>And when did the first stripe occur , say , 0600 Monday local time ?
My first thought .
I bet the first day of this 5-day-period is saturday .</tokentext>
<sentencetext>And when did the first stripe occur, say, 0600 Monday local time?
My first thought.
I bet the first day of this 5-day-period is saturday.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874914</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877200</id>
	<title>Re:Hey mods! Don't mod arkowitz "Troll"</title>
	<author>tenco</author>
	<datestamp>1264333860000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>This guy is obviously trolling slashdot by posting a slashvertisment. I think it's right to mark him as that.</htmltext>
<tokenext>This guy is obviously trolling slashdot by posting a slashvertisment .
I think it 's right to mark him as that .</tokentext>
<sentencetext>This guy is obviously trolling slashdot by posting a slashvertisment.
I think it's right to mark him as that.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876182</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876086</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>arkowitz</author>
	<datestamp>1264272240000</datestamp>
	<modclass>Interestin</modclass>
	<modscore>2</modscore>
	<htmltext>Only change of perspective makes something 3D; this is the point of using a virtual world, so that the user can fly around building a spatial awareness.
<br>
<br>
I do not want to produce a one-time "plot".  I want to show data for what it is.  If it doesn't look as nice as Tufte would have made it look, I don't care.  The point is not to look nice... it's to provide the ability for people to see what is in databases, without bias.  And I still don't think Tufte's paradigms work with as much data as these 3d ones do.</htmltext>
<tokenext>Only change of perspective makes something 3D ; this is the point of using a virtual world , so that the user can fly around building a spatial awareness .
I do not want to produce a one-time " plot " .
I want to show data for what it is .
If it does n't look as nice as Tufte would have made it look , I do n't care .
The point is not to look nice... it 's to provide the ability for people to see what is in databases , without bias .
And I still do n't think Tufte 's paradigms work with as much data as these 3d ones do .</tokentext>
<sentencetext>Only change of perspective makes something 3D; this is the point of using a virtual world, so that the user can fly around building a spatial awareness.
I do not want to produce a one-time "plot".
I want to show data for what it is.
If it doesn't look as nice as Tufte would have made it look, I don't care.
The point is not to look nice... it's to provide the ability for people to see what is in databases, without bias.
And I still don't think Tufte's paradigms work with as much data as these 3d ones do.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875984</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874994</id>
	<title>Several factors contribute to this graphics ...</title>
	<author>GNUALMAFUERTE</author>
	<datestamp>1264261980000</datestamp>
	<modclass>Interestin</modclass>
	<modscore>2</modscore>
	<htmltext><p>First, we would need to know what kind of traffic we are seeing. TCP/UDP? Web? DNS?</p><p>On the other hand, I think you have only partial logs, that would explain many of the blanks on your data. Some blanks are too geometric to be correct, you are probably missing a shitload of data.<br>You have to take into account that, and timezones. Timezones are the key to this. This is probably some public service that gets hit at regular intervals (root DNS server, webserver holding news/stock/climate or similar information, etc). Timezones would explain the pattern. We would need to check times for each country against a timezone table to see if they correlate.<br>I'm also pretty sure that if someone took the time to look at the most active countries, and the less active countries, and some groups in between, we would be able to probably determine what kind of traffic this was.</p><p>Some people mentioned botnets, and it's a big chance that they have a huge influence on this graphs, again, matching timezones against this graph would help us understand.</p><p>I don't know what kind of information does the submitter have on the logs, or how he got them, but if he could post at least a small sample, that would help a lot.<nobr> <wbr></nobr>/methinks that submitter has a lot to do with the tool he's using, and this is just another slashvertisement.</p></htmltext>
<tokenext>First , we would need to know what kind of traffic we are seeing .
TCP/UDP ? Web ?
DNS ? On the other hand , I think you have only partial logs , that would explain many of the blanks on your data .
Some blanks are too geometric to be correct , you are probably missing a shitload of data.You have to take into account that , and timezones .
Timezones are the key to this .
This is probably some public service that gets hit at regular intervals ( root DNS server , webserver holding news/stock/climate or similar information , etc ) .
Timezones would explain the pattern .
We would need to check times for each country against a timezone table to see if they correlate.I 'm also pretty sure that if someone took the time to look at the most active countries , and the less active countries , and some groups in between , we would be able to probably determine what kind of traffic this was.Some people mentioned botnets , and it 's a big chance that they have a huge influence on this graphs , again , matching timezones against this graph would help us understand.I do n't know what kind of information does the submitter have on the logs , or how he got them , but if he could post at least a small sample , that would help a lot .
/methinks that submitter has a lot to do with the tool he 's using , and this is just another slashvertisement .</tokentext>
<sentencetext>First, we would need to know what kind of traffic we are seeing.
TCP/UDP? Web?
DNS?On the other hand, I think you have only partial logs, that would explain many of the blanks on your data.
Some blanks are too geometric to be correct, you are probably missing a shitload of data.You have to take into account that, and timezones.
Timezones are the key to this.
This is probably some public service that gets hit at regular intervals (root DNS server, webserver holding news/stock/climate or similar information, etc).
Timezones would explain the pattern.
We would need to check times for each country against a timezone table to see if they correlate.I'm also pretty sure that if someone took the time to look at the most active countries, and the less active countries, and some groups in between, we would be able to probably determine what kind of traffic this was.Some people mentioned botnets, and it's a big chance that they have a huge influence on this graphs, again, matching timezones against this graph would help us understand.I don't know what kind of information does the submitter have on the logs, or how he got them, but if he could post at least a small sample, that would help a lot.
/methinks that submitter has a lot to do with the tool he's using, and this is just another slashvertisement.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875176</id>
	<title>Uh, that's PETER GIBBONS!</title>
	<author>adosch</author>
	<datestamp>1264263480000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>If that's not the voice of Peter Gibbons from <a href="http://en.wikipedia.org/wiki/Office\_Space" title="wikipedia.org" rel="nofollow">Office Space</a> [wikipedia.org], then slap me silly!</p><p> <i>"...Well, I generally come in at least fifteen minutes late, ah, I use the side door - that way Lumbergh can't see me - and, uh, after that I just sorta space out for about an hour and visualized activity by hour and country.  I... took a bunch of the IP's from the logs, sent them to a company called Initech; Initech took every... (sent millions of them) Initech took every 40th one and sent them to Lumberg's house."</i></p></htmltext>
<tokenext>If that 's not the voice of Peter Gibbons from Office Space [ wikipedia.org ] , then slap me silly !
" ...Well , I generally come in at least fifteen minutes late , ah , I use the side door - that way Lumbergh ca n't see me - and , uh , after that I just sorta space out for about an hour and visualized activity by hour and country .
I... took a bunch of the IP 's from the logs , sent them to a company called Initech ; Initech took every... ( sent millions of them ) Initech took every 40th one and sent them to Lumberg 's house .
"</tokentext>
<sentencetext>If that's not the voice of Peter Gibbons from Office Space [wikipedia.org], then slap me silly!
"...Well, I generally come in at least fifteen minutes late, ah, I use the side door - that way Lumbergh can't see me - and, uh, after that I just sorta space out for about an hour and visualized activity by hour and country.
I... took a bunch of the IP's from the logs, sent them to a company called Initech; Initech took every... (sent millions of them) Initech took every 40th one and sent them to Lumberg's house.
"</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874902</id>
	<title>Re:vertical stripes</title>
	<author>wizardforce</author>
	<datestamp>1264261140000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>This could just be a case where traffic is routed through different proxies at nearly the same time by a relatively small group of computers or Something coordinated many different machines to connect to their server(s) like a botnet.</p></htmltext>
<tokenext>This could just be a case where traffic is routed through different proxies at nearly the same time by a relatively small group of computers or Something coordinated many different machines to connect to their server ( s ) like a botnet .</tokentext>
<sentencetext>This could just be a case where traffic is routed through different proxies at nearly the same time by a relatively small group of computers or Something coordinated many different machines to connect to their server(s) like a botnet.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877000</id>
	<title>Re:vertical stripes</title>
	<author>ebursley</author>
	<datestamp>1264330260000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>I would agree with this assessment. Looks like a control DDoS, but would need to review firewall logs. Would presume this site would also have IDS / IPS measures in place, along with DDoS mitigation.</htmltext>
<tokenext>I would agree with this assessment .
Looks like a control DDoS , but would need to review firewall logs .
Would presume this site would also have IDS / IPS measures in place , along with DDoS mitigation .</tokentext>
<sentencetext>I would agree with this assessment.
Looks like a control DDoS, but would need to review firewall logs.
Would presume this site would also have IDS / IPS measures in place, along with DDoS mitigation.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30899278</id>
	<title>Re:Filter your data...</title>
	<author>Anonymous</author>
	<datestamp>1264431660000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Exactly.  We need to know the timezone and what the hours with the stripes are in order to make any decent guess as to what real-world, non-malicious activities might be causing the stripes.</p></htmltext>
<tokenext>Exactly .
We need to know the timezone and what the hours with the stripes are in order to make any decent guess as to what real-world , non-malicious activities might be causing the stripes .</tokentext>
<sentencetext>Exactly.
We need to know the timezone and what the hours with the stripes are in order to make any decent guess as to what real-world, non-malicious activities might be causing the stripes.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874848</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875842</id>
	<title>Re:vertical stripes</title>
	<author>Anonymous</author>
	<datestamp>1264269720000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>It's the aliens!  They are using our own IP system against us to coordinate their attack on July 4th 2012.</p></htmltext>
<tokenext>It 's the aliens !
They are using our own IP system against us to coordinate their attack on July 4th 2012 .</tokentext>
<sentencetext>It's the aliens!
They are using our own IP system against us to coordinate their attack on July 4th 2012.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878976</id>
	<title>Possibly...</title>
	<author>benjic</author>
	<datestamp>1264353720000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>E.T. Phone Home?</htmltext>
<tokenext>E.T .
Phone Home ?</tokentext>
<sentencetext>E.T.
Phone Home?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876494</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>VoltageX</author>
	<datestamp>1264364520000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>2</modscore>
	<htmltext>The correct response to spam like this is to start and develop a Sourceforge project that contains most, if not all of Glasshouse's features.</htmltext>
<tokenext>The correct response to spam like this is to start and develop a Sourceforge project that contains most , if not all of Glasshouse 's features .</tokentext>
<sentencetext>The correct response to spam like this is to start and develop a Sourceforge project that contains most, if not all of Glasshouse's features.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875114</id>
	<title>Distributed ssh attacks</title>
	<author>discordia666</author>
	<datestamp>1264263000000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Over the past week I've had the following countries hitting my ssh:</p><p>
&nbsp; 108  location: RO<br>
&nbsp; 121  location: CZ<br>
&nbsp; 122  location: HU<br>
&nbsp; 133  location: AU<br>
&nbsp; 142  location: HK<br>
&nbsp; 143  location: MX<br>
&nbsp; 145  location: BR<br>
&nbsp; 151  location: TH<br>
&nbsp; 152  location: CO<br>
&nbsp; 158  location: IN<br>
&nbsp; 183  location: MU<br>
&nbsp; 184  location: NL<br>
&nbsp; 191  location: ES<br>
&nbsp; 205  location: ININ<br>
&nbsp; 234  location: JP<br>
&nbsp; 252  location: FR<br>
&nbsp; 270  location: CA<br>
&nbsp; 306  location: PL<br>
&nbsp; 313  location: GB<br>
&nbsp; 314  location: TW<br>
&nbsp; 355  location: CNCN<br>
&nbsp; 364  location: IT<br>
&nbsp; 379  location: RU<br>
&nbsp; 399  location: KR<br>
&nbsp; 632  location: DE<br>1361  location: CN</p></htmltext>
<tokenext>Over the past week I 've had the following countries hitting my ssh :   108 location : RO   121 location : CZ   122 location : HU   133 location : AU   142 location : HK   143 location : MX   145 location : BR   151 location : TH   152 location : CO   158 location : IN   183 location : MU   184 location : NL   191 location : ES   205 location : ININ   234 location : JP   252 location : FR   270 location : CA   306 location : PL   313 location : GB   314 location : TW   355 location : CNCN   364 location : IT   379 location : RU   399 location : KR   632 location : DE1361 location : CN</tokentext>
<sentencetext>Over the past week I've had the following countries hitting my ssh:
  108  location: RO
  121  location: CZ
  122  location: HU
  133  location: AU
  142  location: HK
  143  location: MX
  145  location: BR
  151  location: TH
  152  location: CO
  158  location: IN
  183  location: MU
  184  location: NL
  191  location: ES
  205  location: ININ
  234  location: JP
  252  location: FR
  270  location: CA
  306  location: PL
  313  location: GB
  314  location: TW
  355  location: CNCN
  364  location: IT
  379  location: RU
  399  location: KR
  632  location: DE1361  location: CN</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876480</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>DesignPsychology</author>
	<datestamp>1264364280000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>+1 for a reference to Edward Tufte regarding visual interpretation.</htmltext>
<tokenext>+ 1 for a reference to Edward Tufte regarding visual interpretation .</tokentext>
<sentencetext>+1 for a reference to Edward Tufte regarding visual interpretation.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875386</id>
	<title>hey, i have access to this amazing tech</title>
	<author>circletimessquare</author>
	<datestamp>1264265520000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>for a powerful client, but i need, you, random slashdork, to help me out here</p><p>no, i'm not a salesman</p></htmltext>
<tokenext>for a powerful client , but i need , you , random slashdork , to help me out hereno , i 'm not a salesman</tokentext>
<sentencetext>for a powerful client, but i need, you, random slashdork, to help me out hereno, i'm not a salesman</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879106</id>
	<title>Birthers</title>
	<author>Anonymous</author>
	<datestamp>1264354560000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>It's the Birthers... very determined... very determined indeed....</p></htmltext>
<tokenext>It 's the Birthers... very determined... very determined indeed... .</tokentext>
<sentencetext>It's the Birthers... very determined... very determined indeed....</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874842</id>
	<title>Interesting.</title>
	<author>Dartz-IRL</author>
	<datestamp>1264260780000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>2</modscore>
	<htmltext><p>It's pretty interesting. You can see the countries with the largest botnets in the log... which also seems to suggest that a large majority of the packets are coming from the one botnet... since a good number of them kick in at the same time.</p><p>It also looks cool. Which is critical.</p></htmltext>
<tokenext>It 's pretty interesting .
You can see the countries with the largest botnets in the log... which also seems to suggest that a large majority of the packets are coming from the one botnet... since a good number of them kick in at the same time.It also looks cool .
Which is critical .</tokentext>
<sentencetext>It's pretty interesting.
You can see the countries with the largest botnets in the log... which also seems to suggest that a large majority of the packets are coming from the one botnet... since a good number of them kick in at the same time.It also looks cool.
Which is critical.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877766</id>
	<title>Re:Looks like a sneaky ad to me.</title>
	<author>HeadlessNotAHorseman</author>
	<datestamp>1264343460000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Please do not encourage anyone to use crystal reports. My limited experience of it has been enough to make me limit my experience of it. It is so full of annoying idiosyncracies and bugs^h^h^h^hfeatures that it nearly drove me (and my team) crazy.</p></htmltext>
<tokenext>Please do not encourage anyone to use crystal reports .
My limited experience of it has been enough to make me limit my experience of it .
It is so full of annoying idiosyncracies and bugs ^ h ^ h ^ h ^ hfeatures that it nearly drove me ( and my team ) crazy .</tokentext>
<sentencetext>Please do not encourage anyone to use crystal reports.
My limited experience of it has been enough to make me limit my experience of it.
It is so full of annoying idiosyncracies and bugs^h^h^h^hfeatures that it nearly drove me (and my team) crazy.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876250</id>
	<title>Re:Looks like a sneaky ad to me.</title>
	<author>flydpnkrtn</author>
	<datestamp>1264274460000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>2</modscore>
	<htmltext><p>I know it's trollish, but the real question is: can kdawson be blocked?</p><p>(yes I know you can block authors in your user prefs... I mean from Slashdot entirely.... save us the pain, please, for the love of god)</p></htmltext>
<tokenext>I know it 's trollish , but the real question is : can kdawson be blocked ?
( yes I know you can block authors in your user prefs... I mean from Slashdot entirely.... save us the pain , please , for the love of god )</tokentext>
<sentencetext>I know it's trollish, but the real question is: can kdawson be blocked?
(yes I know you can block authors in your user prefs... I mean from Slashdot entirely.... save us the pain, please, for the love of god)</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876620</id>
	<title>Re:Looks like a sneaky ad to me.</title>
	<author>adaviel</author>
	<datestamp>1264366080000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Whois providers get pissed off if you start making millions of queries. I used to analyse logs with thousands of entries, and carefully cached netblock ranges in a database to avoid hitting them too often, but that might not scale to millions.</htmltext>
<tokenext>Whois providers get pissed off if you start making millions of queries .
I used to analyse logs with thousands of entries , and carefully cached netblock ranges in a database to avoid hitting them too often , but that might not scale to millions .</tokentext>
<sentencetext>Whois providers get pissed off if you start making millions of queries.
I used to analyse logs with thousands of entries, and carefully cached netblock ranges in a database to avoid hitting them too often, but that might not scale to millions.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875334</id>
	<title>Timezones?</title>
	<author>magamiako1</author>
	<datestamp>1264264980000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Nothing really "interesting". What you notice is that around 9:00PM a bunch of East Asian countries start to show some spiked traffic. My guess is botnets on computers that are being turned on during the day generating a lot of traffic data. Or just computers coming on in general, for anything. There's no context as to what data they were requesting, it could have been simple search hits or image hits, or link hits in google or whatever else. But what it shows to me is nothing more than "hey look, the eastern half of the world wakes up when it's evening time in the US."</htmltext>
<tokenext>Nothing really " interesting " .
What you notice is that around 9 : 00PM a bunch of East Asian countries start to show some spiked traffic .
My guess is botnets on computers that are being turned on during the day generating a lot of traffic data .
Or just computers coming on in general , for anything .
There 's no context as to what data they were requesting , it could have been simple search hits or image hits , or link hits in google or whatever else .
But what it shows to me is nothing more than " hey look , the eastern half of the world wakes up when it 's evening time in the US .
"</tokentext>
<sentencetext>Nothing really "interesting".
What you notice is that around 9:00PM a bunch of East Asian countries start to show some spiked traffic.
My guess is botnets on computers that are being turned on during the day generating a lot of traffic data.
Or just computers coming on in general, for anything.
There's no context as to what data they were requesting, it could have been simple search hits or image hits, or link hits in google or whatever else.
But what it shows to me is nothing more than "hey look, the eastern half of the world wakes up when it's evening time in the US.
"</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874816</id>
	<title>I'm confused</title>
	<author>Anonymous</author>
	<datestamp>1264260660000</datestamp>
	<modclass>Funny</modclass>
	<modscore>2</modscore>
	<htmltext>Is this post an advertisement for Quova or Green Phosphor's Glasshouse?</htmltext>
<tokenext>Is this post an advertisement for Quova or Green Phosphor 's Glasshouse ?</tokentext>
<sentencetext>Is this post an advertisement for Quova or Green Phosphor's Glasshouse?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876836</id>
	<title>News Items on BBC or CNN?</title>
	<author>thingie</author>
	<datestamp>1264326540000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>I'm thinking that the strips are a  news item relevant to the agency running on a world-wide news channel (BBC/CNN/Al Jazeera) and then when a local media picks up the story.</p></htmltext>
<tokenext>I 'm thinking that the strips are a news item relevant to the agency running on a world-wide news channel ( BBC/CNN/Al Jazeera ) and then when a local media picks up the story .</tokentext>
<sentencetext>I'm thinking that the strips are a  news item relevant to the agency running on a world-wide news channel (BBC/CNN/Al Jazeera) and then when a local media picks up the story.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874972</id>
	<title>The smell of fresh grass</title>
	<author>noidentity</author>
	<datestamp>1264261740000</datestamp>
	<modclass>Redundant</modclass>
	<modscore>0</modscore>
	<htmltext>Hmmm, <a href="http://www.knowledgesys.com/" title="knowledgesys.com">I don't know</a> [knowledgesys.com]. As I sit here sipping my <a href="http://www.pepsi.com/" title="pepsi.com">soda</a> [pepsi.com], the <a href="http://www.imagesystemsinc.com/" title="imagesystemsinc.com">imagery</a> [imagesystemsinc.com] <a href="http://www.memotome.com/" title="memotome.com">reminds me</a> [memotome.com] of various things. One <a href="http://www.google.com/search?q=astroturfing+services" title="google.com">thing comes to mind</a> [google.com], though.</htmltext>
<tokenext>Hmmm , I do n't know [ knowledgesys.com ] .
As I sit here sipping my soda [ pepsi.com ] , the imagery [ imagesystemsinc.com ] reminds me [ memotome.com ] of various things .
One thing comes to mind [ google.com ] , though .</tokentext>
<sentencetext>Hmmm, I don't know [knowledgesys.com].
As I sit here sipping my soda [pepsi.com], the imagery [imagesystemsinc.com] reminds me [memotome.com] of various things.
One thing comes to mind [google.com], though.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879530</id>
	<title>Re:Filter your data...</title>
	<author>scottv67</author>
	<datestamp>1264357200000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><i>&gt;If it's from a State agency it's entirely possible that are running a <b>root DNS server</b> on-site (I work st a State agency and we are)</i> <br> <br>
No, you aren't.</htmltext>
<tokenext>&gt; If it 's from a State agency it 's entirely possible that are running a root DNS server on-site ( I work st a State agency and we are ) No , you are n't .</tokentext>
<sentencetext>&gt;If it's from a State agency it's entirely possible that are running a root DNS server on-site (I work st a State agency and we are)  
No, you aren't.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874848</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875006</id>
	<title>check the news for 27 Sept 2009</title>
	<author>Anonymous</author>
	<datestamp>1264262100000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>e.g.<br>http://en.wikipedia.org/wiki/Portal:Current\_events/2009\_September\_27</p><p>Iranian missile tests?<br>Afghanistan surge request?<br>German elections?<br>Ooh - probably the Venezuelan ban on Family Guy - that would surely stir up traffic....</p></htmltext>
<tokenext>e.g.http : //en.wikipedia.org/wiki/Portal : Current \ _events/2009 \ _September \ _27Iranian missile tests ? Afghanistan surge request ? German elections ? Ooh - probably the Venezuelan ban on Family Guy - that would surely stir up traffic... .</tokentext>
<sentencetext>e.g.http://en.wikipedia.org/wiki/Portal:Current\_events/2009\_September\_27Iranian missile tests?Afghanistan surge request?German elections?Ooh - probably the Venezuelan ban on Family Guy - that would surely stir up traffic....</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874800</id>
	<title>What does a normal firewall log look like?</title>
	<author>Anonymous</author>
	<datestamp>1264260540000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext>See title (and answer it).</htmltext>
<tokenext>See title ( and answer it ) .</tokentext>
<sentencetext>See title (and answer it).</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875062</id>
	<title>Re:vertical stripes</title>
	<author>Anonymous</author>
	<datestamp>1264262580000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Agree. It'd be interesting to know what the trigger is for EVERYBODY to hit it at once....</htmltext>
<tokenext>Agree .
It 'd be interesting to know what the trigger is for EVERYBODY to hit it at once... .</tokentext>
<sentencetext>Agree.
It'd be interesting to know what the trigger is for EVERYBODY to hit it at once....</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</id>
	<title>That wasn't complaining. THIS is complaining.</title>
	<author>PCM2</author>
	<datestamp>1264264560000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>5</modscore>
	<htmltext><p>You want complaining? How about this: This visualization is terrible.</p><p>The video took five minutes to watch and most of it was him rolling over the bars in the 3-D chart so you can see what each of the lines means. If that's supposed to be a useful visual aid, I'll eat my hat. It's bad enough that you have to manually roll over every data element to figure out what it is; scrolling through the graph seemed dead slow. I hope that's not a limitation of the product itself.</p><p>Simple labels on the axes of the graph would have been nice. Far be it from anyone to try stick little flags next to the lines to represent different countries. Hell, just color-coding them in a totally arbitrary way would have made the graph easier to read.</p><p>BTW, a quick look at the Glasshouse site reveals <i>all</i> their output looks pretty much just like this demo. And there's no evidence that you can export one of their rudimentary 3-D graphs to "pretty it up" in a real 3-D app. Instead, their raison d'&#234;tre appears to be allowing you to run around looking at these graphs... in Second Life.</p><p>I'm sorry, but if you're doing something like plotting fractals, for example, where visual similarity to patterns is the whole point, I can forgive you for coming to the conclusion that "it's crazy looking." If what you're doing is trying to provide a visual to aid in the interpretation of data, then the visual should -- y'know -- aid interpretation. A glance at this graph, on the other hand, reveals nothing; not even what it's supposed to represent.</p><p>In summary, Edward Tufte will be rolling in his grave when he dies from looking at this graphic.</p></htmltext>
<tokenext>You want complaining ?
How about this : This visualization is terrible.The video took five minutes to watch and most of it was him rolling over the bars in the 3-D chart so you can see what each of the lines means .
If that 's supposed to be a useful visual aid , I 'll eat my hat .
It 's bad enough that you have to manually roll over every data element to figure out what it is ; scrolling through the graph seemed dead slow .
I hope that 's not a limitation of the product itself.Simple labels on the axes of the graph would have been nice .
Far be it from anyone to try stick little flags next to the lines to represent different countries .
Hell , just color-coding them in a totally arbitrary way would have made the graph easier to read.BTW , a quick look at the Glasshouse site reveals all their output looks pretty much just like this demo .
And there 's no evidence that you can export one of their rudimentary 3-D graphs to " pretty it up " in a real 3-D app .
Instead , their raison d '   tre appears to be allowing you to run around looking at these graphs... in Second Life.I 'm sorry , but if you 're doing something like plotting fractals , for example , where visual similarity to patterns is the whole point , I can forgive you for coming to the conclusion that " it 's crazy looking .
" If what you 're doing is trying to provide a visual to aid in the interpretation of data , then the visual should -- y'know -- aid interpretation .
A glance at this graph , on the other hand , reveals nothing ; not even what it 's supposed to represent.In summary , Edward Tufte will be rolling in his grave when he dies from looking at this graphic .</tokentext>
<sentencetext>You want complaining?
How about this: This visualization is terrible.The video took five minutes to watch and most of it was him rolling over the bars in the 3-D chart so you can see what each of the lines means.
If that's supposed to be a useful visual aid, I'll eat my hat.
It's bad enough that you have to manually roll over every data element to figure out what it is; scrolling through the graph seemed dead slow.
I hope that's not a limitation of the product itself.Simple labels on the axes of the graph would have been nice.
Far be it from anyone to try stick little flags next to the lines to represent different countries.
Hell, just color-coding them in a totally arbitrary way would have made the graph easier to read.BTW, a quick look at the Glasshouse site reveals all their output looks pretty much just like this demo.
And there's no evidence that you can export one of their rudimentary 3-D graphs to "pretty it up" in a real 3-D app.
Instead, their raison d'être appears to be allowing you to run around looking at these graphs... in Second Life.I'm sorry, but if you're doing something like plotting fractals, for example, where visual similarity to patterns is the whole point, I can forgive you for coming to the conclusion that "it's crazy looking.
" If what you're doing is trying to provide a visual to aid in the interpretation of data, then the visual should -- y'know -- aid interpretation.
A glance at this graph, on the other hand, reveals nothing; not even what it's supposed to represent.In summary, Edward Tufte will be rolling in his grave when he dies from looking at this graphic.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879554</id>
	<title>Re:"And its freaking crazy looking"</title>
	<author>mr exploiter</author>
	<datestamp>1264357380000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Hey I agree with you but it's not necessary to be so aggressive towards the advertisers, after all they are the ones that allow Slashdot to continue existing.</p></htmltext>
<tokenext>Hey I agree with you but it 's not necessary to be so aggressive towards the advertisers , after all they are the ones that allow Slashdot to continue existing .</tokentext>
<sentencetext>Hey I agree with you but it's not necessary to be so aggressive towards the advertisers, after all they are the ones that allow Slashdot to continue existing.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877450</id>
	<title>Re:It just means</title>
	<author>Anonymous</author>
	<datestamp>1264338180000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p><div class="quote"><p>Btw : looking up a net's country can be done quickly via dns, no need for external company, no need for any tax dollars<nobr> <wbr></nobr>:</p><p>[kimmy@t61 ~]$ host -t TXT 104.79.125.74.cc.iploc.org<br>104.79.125.74.cc.iploc.org descriptive text "US"</p><p>(don't forget to reverse the IP address : looking up 1.2.3.4 is done by host -t TXT 4.3.2.1.cc.iploc.org)</p></div><p>The dns interface sure is nice, too bad ip iploc is wrong in about 100\% of the cases I tried, though.<br>Tried 8 IP addresses belonging to various businesses, organisations and universities in Europe. The closest iploc.org came was NL for a German publisher. The rest was all over the place,mostly US, sometimes CN.</p><p>A quick google for "IP address geocoding" and taking the first result, gave me the following:<br>lynx -dump "http://api.hostip.info/get\_html.php?ip=192.0.32.10"</p><p>100\% correct in my small test sample. Most inaccurate one was "EU" instead of "UK" - not incorrect, just inaccurate.</p></div>
	</htmltext>
<tokenext>Btw : looking up a net 's country can be done quickly via dns , no need for external company , no need for any tax dollars : [ kimmy @ t61 ~ ] $ host -t TXT 104.79.125.74.cc.iploc.org104.79.125.74.cc.iploc.org descriptive text " US " ( do n't forget to reverse the IP address : looking up 1.2.3.4 is done by host -t TXT 4.3.2.1.cc.iploc.org ) The dns interface sure is nice , too bad ip iploc is wrong in about 100 \ % of the cases I tried , though.Tried 8 IP addresses belonging to various businesses , organisations and universities in Europe .
The closest iploc.org came was NL for a German publisher .
The rest was all over the place,mostly US , sometimes CN.A quick google for " IP address geocoding " and taking the first result , gave me the following : lynx -dump " http : //api.hostip.info/get \ _html.php ? ip = 192.0.32.10 " 100 \ % correct in my small test sample .
Most inaccurate one was " EU " instead of " UK " - not incorrect , just inaccurate .</tokentext>
<sentencetext>Btw : looking up a net's country can be done quickly via dns, no need for external company, no need for any tax dollars :[kimmy@t61 ~]$ host -t TXT 104.79.125.74.cc.iploc.org104.79.125.74.cc.iploc.org descriptive text "US"(don't forget to reverse the IP address : looking up 1.2.3.4 is done by host -t TXT 4.3.2.1.cc.iploc.org)The dns interface sure is nice, too bad ip iploc is wrong in about 100\% of the cases I tried, though.Tried 8 IP addresses belonging to various businesses, organisations and universities in Europe.
The closest iploc.org came was NL for a German publisher.
The rest was all over the place,mostly US, sometimes CN.A quick google for "IP address geocoding" and taking the first result, gave me the following:lynx -dump "http://api.hostip.info/get\_html.php?ip=192.0.32.10"100\% correct in my small test sample.
Most inaccurate one was "EU" instead of "UK" - not incorrect, just inaccurate.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875042</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875016</id>
	<title>It looks like</title>
	<author>kilodelta</author>
	<datestamp>1264262160000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Web robots. Just put a robots.txt file in your web directory and that pretty much shuts it down.
<br> <br>
Also take into account that China, Russia, et al are +12 from us So that might explain some of it. In other words, they might be caching your site.</htmltext>
<tokenext>Web robots .
Just put a robots.txt file in your web directory and that pretty much shuts it down .
Also take into account that China , Russia , et al are + 12 from us So that might explain some of it .
In other words , they might be caching your site .</tokentext>
<sentencetext>Web robots.
Just put a robots.txt file in your web directory and that pretty much shuts it down.
Also take into account that China, Russia, et al are +12 from us So that might explain some of it.
In other words, they might be caching your site.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877224</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>tenco</author>
	<datestamp>1264334340000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>Everyone always wants me to have labels on the graphs.</p></div><p>There may be a reason for that, don't you think?</p><p><div class="quote"><p>I don't put them there unless you roll over the data, because I want you to see the patterns in the data without bias first.</p></div><p>How can i see a pattern if i don't know what your tuples consist of? An <i>absolute minimum</i> would have been "time" on the horizontal axis, "country" on the vertical one and "# of packets" on the z-axis. It could as well have been "coffee consumed at govt workstations while browsing slashdot for x mins".</p></div>
	</htmltext>
<tokenext>Everyone always wants me to have labels on the graphs.There may be a reason for that , do n't you think ? I do n't put them there unless you roll over the data , because I want you to see the patterns in the data without bias first.How can i see a pattern if i do n't know what your tuples consist of ?
An absolute minimum would have been " time " on the horizontal axis , " country " on the vertical one and " # of packets " on the z-axis .
It could as well have been " coffee consumed at govt workstations while browsing slashdot for x mins " .</tokentext>
<sentencetext>Everyone always wants me to have labels on the graphs.There may be a reason for that, don't you think?I don't put them there unless you roll over the data, because I want you to see the patterns in the data without bias first.How can i see a pattern if i don't know what your tuples consist of?
An absolute minimum would have been "time" on the horizontal axis, "country" on the vertical one and "# of packets" on the z-axis.
It could as well have been "coffee consumed at govt workstations while browsing slashdot for x mins".
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30917348</id>
	<title>Need to rule out aliasing, confirm accuracy first</title>
	<author>Medievalist</author>
	<datestamp>1264607940000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Try using some other sample intervals and see if your patterns stay consistent.  You might be <a href="http://en.wikipedia.org/wiki/Aliasing" title="wikipedia.org">aliasing</a> [wikipedia.org].</p><p>I'd try 101 and 17 right off the bat, since prime numbers work best for detecting aliasing in my experience (I'm not a mathematician so my methods are empirical, I stole those numbers from bamboo and locusts respectively).</p><p>Those plaids may be an artifact of your sampling interval.  The real patterns might even be <i>more</i> interesting!</p></htmltext>
<tokenext>Try using some other sample intervals and see if your patterns stay consistent .
You might be aliasing [ wikipedia.org ] .I 'd try 101 and 17 right off the bat , since prime numbers work best for detecting aliasing in my experience ( I 'm not a mathematician so my methods are empirical , I stole those numbers from bamboo and locusts respectively ) .Those plaids may be an artifact of your sampling interval .
The real patterns might even be more interesting !</tokentext>
<sentencetext>Try using some other sample intervals and see if your patterns stay consistent.
You might be aliasing [wikipedia.org].I'd try 101 and 17 right off the bat, since prime numbers work best for detecting aliasing in my experience (I'm not a mathematician so my methods are empirical, I stole those numbers from bamboo and locusts respectively).Those plaids may be an artifact of your sampling interval.
The real patterns might even be more interesting!</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877838</id>
	<title>I can't beleive all you slashdoters are missing it</title>
	<author>kurt555gs</author>
	<datestamp>1264344300000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Look at the chart. LOOK. it's obvious what this means.</p><p>BSD is dying!</p></htmltext>
<tokenext>Look at the chart .
LOOK. it 's obvious what this means.BSD is dying !</tokentext>
<sentencetext>Look at the chart.
LOOK. it's obvious what this means.BSD is dying!</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875946</id>
	<title>Re:vertical stripes</title>
	<author>Animats</author>
	<datestamp>1264270680000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>
<i>I'm actually a lot more interested in the vertical stripes than the horizontal ones. It looks like at certain times, every country in the world sends a packet.</i>
</p><p>
Yes, I noticed that.  The edges on the stripes are so sharp that I suspect a bug in the analysis or graphing program.  Either he's being attacked intermittently by an widespread, tightly synchronized botnet, or the breakdown by country is bogus.  I'll bet he has some bug like getting the bytes of an IP address backwards, so when he gets a traffic spike, it looks like it comes from all over the world.
With his crap visualization program, you can't tell. His "3D" visualization of a 2D graph would be more useful if you
could zoom in.</p></htmltext>
<tokenext>I 'm actually a lot more interested in the vertical stripes than the horizontal ones .
It looks like at certain times , every country in the world sends a packet .
Yes , I noticed that .
The edges on the stripes are so sharp that I suspect a bug in the analysis or graphing program .
Either he 's being attacked intermittently by an widespread , tightly synchronized botnet , or the breakdown by country is bogus .
I 'll bet he has some bug like getting the bytes of an IP address backwards , so when he gets a traffic spike , it looks like it comes from all over the world .
With his crap visualization program , you ca n't tell .
His " 3D " visualization of a 2D graph would be more useful if you could zoom in .</tokentext>
<sentencetext>
I'm actually a lot more interested in the vertical stripes than the horizontal ones.
It looks like at certain times, every country in the world sends a packet.
Yes, I noticed that.
The edges on the stripes are so sharp that I suspect a bug in the analysis or graphing program.
Either he's being attacked intermittently by an widespread, tightly synchronized botnet, or the breakdown by country is bogus.
I'll bet he has some bug like getting the bytes of an IP address backwards, so when he gets a traffic spike, it looks like it comes from all over the world.
With his crap visualization program, you can't tell.
His "3D" visualization of a 2D graph would be more useful if you
could zoom in.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875216</id>
	<title>CrazyFireWallActivityGenerator.c</title>
	<author>mysidia</author>
	<datestamp>1264263900000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p> <tt>
GenerateCrazyFirewallActivity( struct in\_addr dest[NUM\_TARGETS], int hour, int minute  ) {<br>
     int i,SpoofPackets[NUM\_COUNTRIES][HOURS\_OF\_THE\_DAY]<br> = { { 10, 17} ,<nobr> <wbr></nobr>.... }<nobr> <wbr></nobr>;<br>
     for(j=0;j&lt;NUM\_TARGETS;j++) for(i=0;i&lt;NUM\_COUNTRIES) {  count=SpoofPackets[j][hour] * random\_fraction() +  (confuse\_the\_hell\_out\_of\_them ? 100 : 0); SpoofPacketsTo(dest[i],count) }
<br>
 }
</tt>
</p></htmltext>
<tokenext>GenerateCrazyFirewallActivity ( struct in \ _addr dest [ NUM \ _TARGETS ] , int hour , int minute ) { int i,SpoofPackets [ NUM \ _COUNTRIES ] [ HOURS \ _OF \ _THE \ _DAY ] = { { 10 , 17 } , .... } ; for ( j = 0 ; j }</tokentext>
<sentencetext> 
GenerateCrazyFirewallActivity( struct in\_addr dest[NUM\_TARGETS], int hour, int minute  ) {
     int i,SpoofPackets[NUM\_COUNTRIES][HOURS\_OF\_THE\_DAY] = { { 10, 17} , .... } ;
     for(j=0;j
 }

</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875556</id>
	<title>Re: I think you are quite correct</title>
	<author>arkowitz</author>
	<datestamp>1264267380000</datestamp>
	<modclass>Troll</modclass>
	<modscore>-1</modscore>
	<htmltext>I just looked at it by port and hour... and the stripes come from activity targeted to port 137, and portless (ICMP type).

The people at this particular agency are not idiots, and all this is denied by the firewall... but I find it fascinating to see the botnets in action.  And that cluster of activity coming from Russia is really interesting too.</htmltext>
<tokenext>I just looked at it by port and hour... and the stripes come from activity targeted to port 137 , and portless ( ICMP type ) .
The people at this particular agency are not idiots , and all this is denied by the firewall... but I find it fascinating to see the botnets in action .
And that cluster of activity coming from Russia is really interesting too .</tokentext>
<sentencetext>I just looked at it by port and hour... and the stripes come from activity targeted to port 137, and portless (ICMP type).
The people at this particular agency are not idiots, and all this is denied by the firewall... but I find it fascinating to see the botnets in action.
And that cluster of activity coming from Russia is really interesting too.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875042</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877258</id>
	<title>Re:The reason is quite obvious:</title>
	<author>tenco</author>
	<datestamp>1264334760000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>I also don't get what he meant by "unique IP".</htmltext>
<tokenext>I also do n't get what he meant by " unique IP " .</tokentext>
<sentencetext>I also don't get what he meant by "unique IP".</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875900</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876182</id>
	<title>Hey mods! Don't mod arkowitz "Troll"</title>
	<author>Anonymous</author>
	<datestamp>1264273380000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>2</modscore>
	<htmltext><p>This is the guy whose product we're talking about. He wants to explain himself. If you think he tried to use Slashdot to advertise his product, you don't have to mod him up, but if you mod him down to -1 then  he'll drop below a lot of people's thresholds and they won't even see that he tried to participate. That's not being fair.</p></htmltext>
<tokenext>This is the guy whose product we 're talking about .
He wants to explain himself .
If you think he tried to use Slashdot to advertise his product , you do n't have to mod him up , but if you mod him down to -1 then he 'll drop below a lot of people 's thresholds and they wo n't even see that he tried to participate .
That 's not being fair .</tokentext>
<sentencetext>This is the guy whose product we're talking about.
He wants to explain himself.
If you think he tried to use Slashdot to advertise his product, you don't have to mod him up, but if you mod him down to -1 then  he'll drop below a lot of people's thresholds and they won't even see that he tried to participate.
That's not being fair.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878356</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>Anonymous</author>
	<datestamp>1264349640000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Did Edward Tufte died?</p></htmltext>
<tokenext>Did Edward Tufte died ?</tokentext>
<sentencetext>Did Edward Tufte died?</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875984</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874856</id>
	<title>Intel</title>
	<author>MandoSKippy</author>
	<datestamp>1264260900000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>I would have to say that the countries of interest on the graph seem to be the countries of interest from a malware/hacking perspective.  Perhaps it's bot net activity where there is a large amount of port scans that kickoff from all over the world and then some of the "increase" after the lines would be further recon activity.  All very interesting.</htmltext>
<tokenext>I would have to say that the countries of interest on the graph seem to be the countries of interest from a malware/hacking perspective .
Perhaps it 's bot net activity where there is a large amount of port scans that kickoff from all over the world and then some of the " increase " after the lines would be further recon activity .
All very interesting .</tokentext>
<sentencetext>I would have to say that the countries of interest on the graph seem to be the countries of interest from a malware/hacking perspective.
Perhaps it's bot net activity where there is a large amount of port scans that kickoff from all over the world and then some of the "increase" after the lines would be further recon activity.
All very interesting.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876352</id>
	<title>Re:The reason is quite obvious:</title>
	<author>benjamindees</author>
	<datestamp>1264275780000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>It wasn't every 40th packet.  It was every 40th IP address.</p></htmltext>
<tokenext>It was n't every 40th packet .
It was every 40th IP address .</tokentext>
<sentencetext>It wasn't every 40th packet.
It was every 40th IP address.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875900</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874866</id>
	<title>I see the people who have a clue haven't gotten</title>
	<author>jra</author>
	<datestamp>1264260960000</datestamp>
	<modclass>Redundant</modclass>
	<modscore>0</modscore>
	<htmltext><p>here yet.<nobr> <wbr></nobr>:-)</p><p>Though I did like the Guitar Hero riff..</p><p>The time-based stripes look like a botnet being triggered.  It's possible the increases in traffic from certain places after the stripe pattern commenced might be due to distribution in infections by a botnet client.</p><p>To make any real judgement on that, it would probably be necessary to see more like 6 months worth of data all at the same time.</p><p>I suspect Bill Cheswick and Steven Bellovin might have some interesting comment to make on this; I chat with Steve occasionally; I'll point him at the thread.  (For those not playing the home game; they wrote the Wily Hacker book, and used to run AT&amp;T's corporate firewall.)</p></htmltext>
<tokenext>here yet .
: - ) Though I did like the Guitar Hero riff..The time-based stripes look like a botnet being triggered .
It 's possible the increases in traffic from certain places after the stripe pattern commenced might be due to distribution in infections by a botnet client.To make any real judgement on that , it would probably be necessary to see more like 6 months worth of data all at the same time.I suspect Bill Cheswick and Steven Bellovin might have some interesting comment to make on this ; I chat with Steve occasionally ; I 'll point him at the thread .
( For those not playing the home game ; they wrote the Wily Hacker book , and used to run AT&amp;T 's corporate firewall .
)</tokentext>
<sentencetext>here yet.
:-)Though I did like the Guitar Hero riff..The time-based stripes look like a botnet being triggered.
It's possible the increases in traffic from certain places after the stripe pattern commenced might be due to distribution in infections by a botnet client.To make any real judgement on that, it would probably be necessary to see more like 6 months worth of data all at the same time.I suspect Bill Cheswick and Steven Bellovin might have some interesting comment to make on this; I chat with Steve occasionally; I'll point him at the thread.
(For those not playing the home game; they wrote the Wily Hacker book, and used to run AT&amp;T's corporate firewall.
)</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875872</id>
	<title>TCP/IP for Dummies?</title>
	<author>Gothmolly</author>
	<datestamp>1264269960000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>It means that some IP spaces are used more heavily, and that if you don't care about getting a response (hello, UDP) then you can make your traffic come from anywhere.</p><p>The real question is - if you don't know what this means, why in gods name did the US Gov hand over the logs to you??</p></htmltext>
<tokenext>It means that some IP spaces are used more heavily , and that if you do n't care about getting a response ( hello , UDP ) then you can make your traffic come from anywhere.The real question is - if you do n't know what this means , why in gods name did the US Gov hand over the logs to you ?
?</tokentext>
<sentencetext>It means that some IP spaces are used more heavily, and that if you don't care about getting a response (hello, UDP) then you can make your traffic come from anywhere.The real question is - if you don't know what this means, why in gods name did the US Gov hand over the logs to you?
?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875120</id>
	<title>what when where who?</title>
	<author>quantumpineal</author>
	<datestamp>1264263000000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>there's absolutely no context given at all here. and the fact that ips are coming from different countries could simply mean that proxies are being used in those countries. you say you work for the government?</htmltext>
<tokenext>there 's absolutely no context given at all here .
and the fact that ips are coming from different countries could simply mean that proxies are being used in those countries .
you say you work for the government ?</tokentext>
<sentencetext>there's absolutely no context given at all here.
and the fact that ips are coming from different countries could simply mean that proxies are being used in those countries.
you say you work for the government?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874862</id>
	<title>obviously</title>
	<author>flyneye</author>
	<datestamp>1264260900000</datestamp>
	<modclass>Offtopic</modclass>
	<modscore>0</modscore>
	<htmltext><p>It's a Denial of Reality attack from Democratic Chinese Youth for Christ protesting Iraqi Bacon Bits embargo.<br>Go figure.  You could probably blame Hillbillary Clinton for refusing to recognize Constitutional Rights.  I'm sure the attack will subside when we send Sen. Tedward Kennedy over to give swimming lessons. This international diplomacy thing isn't hard to figure out. We'll just let the Wichita Air Nat'l Guard fire up their Windoze boxes and challenge them to a round of GO.</p></htmltext>
<tokenext>It 's a Denial of Reality attack from Democratic Chinese Youth for Christ protesting Iraqi Bacon Bits embargo.Go figure .
You could probably blame Hillbillary Clinton for refusing to recognize Constitutional Rights .
I 'm sure the attack will subside when we send Sen. Tedward Kennedy over to give swimming lessons .
This international diplomacy thing is n't hard to figure out .
We 'll just let the Wichita Air Nat'l Guard fire up their Windoze boxes and challenge them to a round of GO .</tokentext>
<sentencetext>It's a Denial of Reality attack from Democratic Chinese Youth for Christ protesting Iraqi Bacon Bits embargo.Go figure.
You could probably blame Hillbillary Clinton for refusing to recognize Constitutional Rights.
I'm sure the attack will subside when we send Sen. Tedward Kennedy over to give swimming lessons.
This international diplomacy thing isn't hard to figure out.
We'll just let the Wichita Air Nat'l Guard fire up their Windoze boxes and challenge them to a round of GO.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875498</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>melikamp</author>
	<datestamp>1264266780000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>You bring up a good point: the raw data would be more eye-friendly than this travesty.
But also, if it's not backed up by the free and open raw data - that is, if there is such data,
but it's being kept secret - then it cannot be good science.</p></htmltext>
<tokenext>You bring up a good point : the raw data would be more eye-friendly than this travesty .
But also , if it 's not backed up by the free and open raw data - that is , if there is such data , but it 's being kept secret - then it can not be good science .</tokentext>
<sentencetext>You bring up a good point: the raw data would be more eye-friendly than this travesty.
But also, if it's not backed up by the free and open raw data - that is, if there is such data,
but it's being kept secret - then it cannot be good science.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877432</id>
	<title>Worst. Advert. Ever.</title>
	<author>Anonymous</author>
	<datestamp>1264337700000</datestamp>
	<modclass>Funny</modclass>
	<modscore>1</modscore>
	<htmltext><p>"Hi!  I've created this awesome freaky-looking visualisation tool!  It's so fucking useless that even I, the author, can't actually determine any useful information from the output it shows me, so I have to go ask some random commenters on a website if they've got a single sodding clue what's going on.</p><p>Wanna buy it?"</p></htmltext>
<tokenext>" Hi !
I 've created this awesome freaky-looking visualisation tool !
It 's so fucking useless that even I , the author , ca n't actually determine any useful information from the output it shows me , so I have to go ask some random commenters on a website if they 've got a single sodding clue what 's going on.Wan na buy it ?
"</tokentext>
<sentencetext>"Hi!
I've created this awesome freaky-looking visualisation tool!
It's so fucking useless that even I, the author, can't actually determine any useful information from the output it shows me, so I have to go ask some random commenters on a website if they've got a single sodding clue what's going on.Wanna buy it?
"</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30880494</id>
	<title>You are ready for the second stage</title>
	<author>n2rjt</author>
	<datestamp>1264361880000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Now that you have isolated a few categories of interesting packets, you should study samples of those interesting packets in more detail. Many have speculated about what the "stripes" mean, but you can find out more by investigating one stripe.</p></htmltext>
<tokenext>Now that you have isolated a few categories of interesting packets , you should study samples of those interesting packets in more detail .
Many have speculated about what the " stripes " mean , but you can find out more by investigating one stripe .</tokentext>
<sentencetext>Now that you have isolated a few categories of interesting packets, you should study samples of those interesting packets in more detail.
Many have speculated about what the "stripes" mean, but you can find out more by investigating one stripe.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875972</id>
	<title>Statistically flwed?</title>
	<author>viking80</author>
	<datestamp>1264270920000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>It appears that the big countries, like china, and india shows up with more hits than the small countires like angola and cuba.</p><p>I wonder what that can mean? Is it similar to the statistical fact that most truck accidents happen in US made trucks?</p><p>In the latter, until you factor in that 95\% of US trucks are made in the US, you have only meaningless statistics.</p><p>It seems that current incarnation of this analysis tool suffers the same flaw.</p></htmltext>
<tokenext>It appears that the big countries , like china , and india shows up with more hits than the small countires like angola and cuba.I wonder what that can mean ?
Is it similar to the statistical fact that most truck accidents happen in US made trucks ? In the latter , until you factor in that 95 \ % of US trucks are made in the US , you have only meaningless statistics.It seems that current incarnation of this analysis tool suffers the same flaw .</tokentext>
<sentencetext>It appears that the big countries, like china, and india shows up with more hits than the small countires like angola and cuba.I wonder what that can mean?
Is it similar to the statistical fact that most truck accidents happen in US made trucks?In the latter, until you factor in that 95\% of US trucks are made in the US, you have only meaningless statistics.It seems that current incarnation of this analysis tool suffers the same flaw.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877308</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>dr\_blurb</author>
	<datestamp>1264335720000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>You want complaining? How about this: This visualization is terrible.</p><p>The video took five minutes to watch and most of it was him rolling over the bars in the 3-D chart so you can see what each of the lines means.</p></div><p>
Try watching it with the sound off, which is my lithmus test for visualization videos: if you can understand fairly quickly what's going on from the visuals only, then it's a good visualization.
</p><p>
Needless to say, this video fails.
</p></div>
	</htmltext>
<tokenext>You want complaining ?
How about this : This visualization is terrible.The video took five minutes to watch and most of it was him rolling over the bars in the 3-D chart so you can see what each of the lines means .
Try watching it with the sound off , which is my lithmus test for visualization videos : if you can understand fairly quickly what 's going on from the visuals only , then it 's a good visualization .
Needless to say , this video fails .</tokentext>
<sentencetext>You want complaining?
How about this: This visualization is terrible.The video took five minutes to watch and most of it was him rolling over the bars in the 3-D chart so you can see what each of the lines means.
Try watching it with the sound off, which is my lithmus test for visualization videos: if you can understand fairly quickly what's going on from the visuals only, then it's a good visualization.
Needless to say, this video fails.

	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392</id>
	<title>Looks like a sneaky ad to me.</title>
	<author>Anonymous</author>
	<datestamp>1264265580000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>5</modscore>
	<htmltext>I see no reason whatever that it would be necessary to use either Quova or Green Phosphor. Any competent programmer could have sampled the data, used whois to get location, and then used about 1000 different programs to visualize the data just as well. (Like Crystal Reports or Seagate.)
<br> <br>
The fact that OP did neither, and is involved at a high level with one of the two companies, makes this whole post suspicious.
<br> <br>
My best guess is that OP thought he had discovered a way to freely advertise via Slashdot, and victimized us as a result.
<br> <br>
I get enough Spam. I don't need to see even more, on Slashdot. Can this user be blocked?</htmltext>
<tokenext>I see no reason whatever that it would be necessary to use either Quova or Green Phosphor .
Any competent programmer could have sampled the data , used whois to get location , and then used about 1000 different programs to visualize the data just as well .
( Like Crystal Reports or Seagate .
) The fact that OP did neither , and is involved at a high level with one of the two companies , makes this whole post suspicious .
My best guess is that OP thought he had discovered a way to freely advertise via Slashdot , and victimized us as a result .
I get enough Spam .
I do n't need to see even more , on Slashdot .
Can this user be blocked ?</tokentext>
<sentencetext>I see no reason whatever that it would be necessary to use either Quova or Green Phosphor.
Any competent programmer could have sampled the data, used whois to get location, and then used about 1000 different programs to visualize the data just as well.
(Like Crystal Reports or Seagate.
)
 
The fact that OP did neither, and is involved at a high level with one of the two companies, makes this whole post suspicious.
My best guess is that OP thought he had discovered a way to freely advertise via Slashdot, and victimized us as a result.
I get enough Spam.
I don't need to see even more, on Slashdot.
Can this user be blocked?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875826</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>Eightbitgnosis</author>
	<datestamp>1264269600000</datestamp>
	<modclass>Troll</modclass>
	<modscore>0</modscore>
	<htmltext>Well, feel free to start a company anytime since you see it so clearly</htmltext>
<tokenext>Well , feel free to start a company anytime since you see it so clearly</tokentext>
<sentencetext>Well, feel free to start a company anytime since you see it so clearly</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878190</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>Rogerborg</author>
	<datestamp>1264348140000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><blockquote><div><p>What gives</p></div></blockquote><p>Really?  You have to ask.  Let me draw your attention to...</p><blockquote><div><p>Posted by kdawson</p></div></blockquote><p>Further comment would be superfluous.</p></div>
	</htmltext>
<tokenext>What givesReally ?
You have to ask .
Let me draw your attention to...Posted by kdawsonFurther comment would be superfluous .</tokentext>
<sentencetext>What givesReally?
You have to ask.
Let me draw your attention to...Posted by kdawsonFurther comment would be superfluous.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875244</id>
	<title>Bot-Net attack</title>
	<author>MasterOfGoingFaster</author>
	<datestamp>1264264200000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>I'd guess you are seeing a bot-net attack.  The bot-net army would have the greatest numbers in IT-heavy countries (US, India, China). The command structure would cause them all to attack at (roughly) the same time, regardless of time zone.</p><p>Or maybe you've been slashdotted.</p></htmltext>
<tokenext>I 'd guess you are seeing a bot-net attack .
The bot-net army would have the greatest numbers in IT-heavy countries ( US , India , China ) .
The command structure would cause them all to attack at ( roughly ) the same time , regardless of time zone.Or maybe you 've been slashdotted .</tokentext>
<sentencetext>I'd guess you are seeing a bot-net attack.
The bot-net army would have the greatest numbers in IT-heavy countries (US, India, China).
The command structure would cause them all to attack at (roughly) the same time, regardless of time zone.Or maybe you've been slashdotted.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879036</id>
	<title>Do you know...</title>
	<author>multimediavt</author>
	<datestamp>1264354140000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>...what new sites or services started the day of the first stripe? Given that you did a every 40th sample this could potentially be a <a href="http://en.wikipedia.org/wiki/Sampling\_error" title="wikipedia.org">sampling error</a> [wikipedia.org], or a <a href="http://en.wikipedia.org/wiki/Moir\_pattern" title="wikipedia.org">moire pattern</a> [wikipedia.org] caused by said sampling error.</p><p>I'd go with a site or service coming online somewhere within the organization where the data came from. If it's a higher-education institution it could have been anything or anyone setting up a website, or it could even have been a trojan or virus that is now using a machine to tunnel through the firewall and share music, video or warez.</p><p>Happy Hunting!</p></htmltext>
<tokenext>...what new sites or services started the day of the first stripe ?
Given that you did a every 40th sample this could potentially be a sampling error [ wikipedia.org ] , or a moire pattern [ wikipedia.org ] caused by said sampling error.I 'd go with a site or service coming online somewhere within the organization where the data came from .
If it 's a higher-education institution it could have been anything or anyone setting up a website , or it could even have been a trojan or virus that is now using a machine to tunnel through the firewall and share music , video or warez.Happy Hunting !</tokentext>
<sentencetext>...what new sites or services started the day of the first stripe?
Given that you did a every 40th sample this could potentially be a sampling error [wikipedia.org], or a moire pattern [wikipedia.org] caused by said sampling error.I'd go with a site or service coming online somewhere within the organization where the data came from.
If it's a higher-education institution it could have been anything or anyone setting up a website, or it could even have been a trojan or virus that is now using a machine to tunnel through the firewall and share music, video or warez.Happy Hunting!</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876328</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>Cyberllama</author>
	<datestamp>1264275480000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>It wasn't pretty, I'll grant you that -- but it wasn't a very obtuse representation.  It very clearly shows a pattern, and it's vaguely interesting -- if you're into that sort of thing.  The guy found something neat and thought he could talk about it and maybe promote his software at the same time.  It's not that big of a deal.  Yes, it's a bit deceptive the way its worded that he says "I used XXXX Software" without disclosing that he's the guy who made it --  it's clearly shameless self-promotion, but that sort of thing is par for the course with most Ask Slashdot posts.  Nobody really cares as long as there's some actual content to discuss.</p><p>I don't think it's super mysterious, however.  It's clearly botnet activity.  You get a sudden influx of connections from all over the world creating each of the 4-5 lines, and the countries which show the significant increase in activity past that point happen to be the ones which are known to be the most "wired" (and thus have the most bots): Russia, India, Brazil, China.</p><p>I'm sure there's more to the story than that, but asking why a botnet attacks a US Government Agency is like asking why the sun shines.  If you really want to know more than that, you need more data than you apparently have.</p></htmltext>
<tokenext>It was n't pretty , I 'll grant you that -- but it was n't a very obtuse representation .
It very clearly shows a pattern , and it 's vaguely interesting -- if you 're into that sort of thing .
The guy found something neat and thought he could talk about it and maybe promote his software at the same time .
It 's not that big of a deal .
Yes , it 's a bit deceptive the way its worded that he says " I used XXXX Software " without disclosing that he 's the guy who made it -- it 's clearly shameless self-promotion , but that sort of thing is par for the course with most Ask Slashdot posts .
Nobody really cares as long as there 's some actual content to discuss.I do n't think it 's super mysterious , however .
It 's clearly botnet activity .
You get a sudden influx of connections from all over the world creating each of the 4-5 lines , and the countries which show the significant increase in activity past that point happen to be the ones which are known to be the most " wired " ( and thus have the most bots ) : Russia , India , Brazil , China.I 'm sure there 's more to the story than that , but asking why a botnet attacks a US Government Agency is like asking why the sun shines .
If you really want to know more than that , you need more data than you apparently have .</tokentext>
<sentencetext>It wasn't pretty, I'll grant you that -- but it wasn't a very obtuse representation.
It very clearly shows a pattern, and it's vaguely interesting -- if you're into that sort of thing.
The guy found something neat and thought he could talk about it and maybe promote his software at the same time.
It's not that big of a deal.
Yes, it's a bit deceptive the way its worded that he says "I used XXXX Software" without disclosing that he's the guy who made it --  it's clearly shameless self-promotion, but that sort of thing is par for the course with most Ask Slashdot posts.
Nobody really cares as long as there's some actual content to discuss.I don't think it's super mysterious, however.
It's clearly botnet activity.
You get a sudden influx of connections from all over the world creating each of the 4-5 lines, and the countries which show the significant increase in activity past that point happen to be the ones which are known to be the most "wired" (and thus have the most bots): Russia, India, Brazil, China.I'm sure there's more to the story than that, but asking why a botnet attacks a US Government Agency is like asking why the sun shines.
If you really want to know more than that, you need more data than you apparently have.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876406</id>
	<title>I know what it is...</title>
	<author>Anonymous</author>
	<datestamp>1264276740000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>God.</p></htmltext>
<tokenext>God .</tokentext>
<sentencetext>God.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874962</id>
	<title>tubg1rl</title>
	<author>Anonymous</author>
	<datestamp>1264261680000</datestamp>
	<modclass>Troll</modclass>
	<modscore>-1</modscore>
	<htmltext><A HREF="http://goat.cx/" title="goat.cx" rel="nofollow">benefits of being of the waaring of BSD/OS. A I read the latest</a> [goat.cx]</htmltext>
<tokenext>benefits of being of the waaring of BSD/OS .
A I read the latest [ goat.cx ]</tokentext>
<sentencetext>benefits of being of the waaring of BSD/OS.
A I read the latest [goat.cx]</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875140</id>
	<title>Great ways to start a conversation</title>
	<author>Anonymous</author>
	<datestamp>1264263180000</datestamp>
	<modclass>Funny</modclass>
	<modscore>5</modscore>
	<htmltext><p>"I happened to have access to five days worth of firewall logs from a US state government agency..."</p><p>"While skimming through my grandmother's cookbook, I stumbled upon a recipe for processing yellowcake uranium..."</p><p>"In passing, a close personal friend mentioned to me that he would deploy ~30k troops to a Mideastern country, but he's worried that the local restaurantuers won't serve fresh babaganoush<nobr> <wbr></nobr>..."</p><p>"While I was talking to a famous adult film star about my successful experiment with cold fusion..."</p><p>"I was fighting against an alien invasion of the Soviet Union the other day. Natalie Portman and I prepared a platoon of sharks with frickin' hotgrits cannons on their heads, but the unwelcome overlords kept jumping the sharks..."</p></htmltext>
<tokenext>" I happened to have access to five days worth of firewall logs from a US state government agency... " " While skimming through my grandmother 's cookbook , I stumbled upon a recipe for processing yellowcake uranium... " " In passing , a close personal friend mentioned to me that he would deploy ~ 30k troops to a Mideastern country , but he 's worried that the local restaurantuers wo n't serve fresh babaganoush ... " " While I was talking to a famous adult film star about my successful experiment with cold fusion... " " I was fighting against an alien invasion of the Soviet Union the other day .
Natalie Portman and I prepared a platoon of sharks with frickin ' hotgrits cannons on their heads , but the unwelcome overlords kept jumping the sharks... "</tokentext>
<sentencetext>"I happened to have access to five days worth of firewall logs from a US state government agency...""While skimming through my grandmother's cookbook, I stumbled upon a recipe for processing yellowcake uranium...""In passing, a close personal friend mentioned to me that he would deploy ~30k troops to a Mideastern country, but he's worried that the local restaurantuers won't serve fresh babaganoush ...""While I was talking to a famous adult film star about my successful experiment with cold fusion...""I was fighting against an alien invasion of the Soviet Union the other day.
Natalie Portman and I prepared a platoon of sharks with frickin' hotgrits cannons on their heads, but the unwelcome overlords kept jumping the sharks..."</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877542</id>
	<title>Different perspective</title>
	<author>Anonymous</author>
	<datestamp>1264339800000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Have you ever decided to look at the spikes from the various countries on their "Local Time"?   That might show a pattern.  Like all spikes might happen at 8:00 AM every morning for every country.</p><p>Also; have you tried  resolving groups of IP?  Have you check the IP's or  blocks of IP's against various "black lists"..... There is a good chance that these are part of various botnets.</p><p>Just some different ways to look at the  problem.... Hope something pans out...</p></htmltext>
<tokenext>Have you ever decided to look at the spikes from the various countries on their " Local Time " ?
That might show a pattern .
Like all spikes might happen at 8 : 00 AM every morning for every country.Also ; have you tried resolving groups of IP ?
Have you check the IP 's or blocks of IP 's against various " black lists " ..... There is a good chance that these are part of various botnets.Just some different ways to look at the problem.... Hope something pans out.. .</tokentext>
<sentencetext>Have you ever decided to look at the spikes from the various countries on their "Local Time"?
That might show a pattern.
Like all spikes might happen at 8:00 AM every morning for every country.Also; have you tried  resolving groups of IP?
Have you check the IP's or  blocks of IP's against various "black lists"..... There is a good chance that these are part of various botnets.Just some different ways to look at the  problem.... Hope something pans out...</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875524</id>
	<title>Re:vertical stripes</title>
	<author>Anonymous</author>
	<datestamp>1264267140000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><blockquote><div><p>The spiked country traffic are probably the controlled bots attacking the host actively.</p></div></blockquote><p>Personally I thought the spiked country stuff was really uninteresting.  For example, a simple explanation like time zones would suffice.  In one period, people from Europe will be doing something, during another period you'll get Asia, and another for the Americas, etc...</p></div>
	</htmltext>
<tokenext>The spiked country traffic are probably the controlled bots attacking the host actively.Personally I thought the spiked country stuff was really uninteresting .
For example , a simple explanation like time zones would suffice .
In one period , people from Europe will be doing something , during another period you 'll get Asia , and another for the Americas , etc.. .</tokentext>
<sentencetext>The spiked country traffic are probably the controlled bots attacking the host actively.Personally I thought the spiked country stuff was really uninteresting.
For example, a simple explanation like time zones would suffice.
In one period, people from Europe will be doing something, during another period you'll get Asia, and another for the Americas, etc...
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874904</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>Jah-Wren Ryel</author>
	<datestamp>1264261140000</datestamp>
	<modclass>Informativ</modclass>
	<modscore>5</modscore>
	<htmltext><p><div class="quote"><p>Wait, is this just an advertisement for Glasshouse? The voice in the video on Green Phosphor's website is exactly the same.</p></div><p>It is totally the same guy - the background noise sounds identical too - like he recorded it on the same microphone with the same environmental conditions.<br>Hell, he even starts each narration exactly the same with the pattern of, "Hi &lt;name&gt; here."</p></div>
	</htmltext>
<tokenext>Wait , is this just an advertisement for Glasshouse ?
The voice in the video on Green Phosphor 's website is exactly the same.It is totally the same guy - the background noise sounds identical too - like he recorded it on the same microphone with the same environmental conditions.Hell , he even starts each narration exactly the same with the pattern of , " Hi here .
"</tokentext>
<sentencetext>Wait, is this just an advertisement for Glasshouse?
The voice in the video on Green Phosphor's website is exactly the same.It is totally the same guy - the background noise sounds identical too - like he recorded it on the same microphone with the same environmental conditions.Hell, he even starts each narration exactly the same with the pattern of, "Hi  here.
"
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875164</id>
	<title>Time zones and day of week</title>
	<author>Anonymous</author>
	<datestamp>1264263420000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Group countries by timezone they appear in.  You may see spikes correlated to zone.  Also think about the day of week.  Not everybody has the same days or any days off.</p></htmltext>
<tokenext>Group countries by timezone they appear in .
You may see spikes correlated to zone .
Also think about the day of week .
Not everybody has the same days or any days off .</tokentext>
<sentencetext>Group countries by timezone they appear in.
You may see spikes correlated to zone.
Also think about the day of week.
Not everybody has the same days or any days off.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877566</id>
	<title>Re:Skylab Shreds</title>
	<author>Ihmhi</author>
	<datestamp>1264340100000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>I'm not sure, I can't really parse the data mentally on a 2-D plane. Perhaps he should get one of the computers <a href="http://www.youtube.com/watch?v=Ql1uLyuWra8" title="youtube.com">these guys</a> [youtube.com] use and cook up some 3D cityscape models.</p></htmltext>
<tokenext>I 'm not sure , I ca n't really parse the data mentally on a 2-D plane .
Perhaps he should get one of the computers these guys [ youtube.com ] use and cook up some 3D cityscape models .</tokentext>
<sentencetext>I'm not sure, I can't really parse the data mentally on a 2-D plane.
Perhaps he should get one of the computers these guys [youtube.com] use and cook up some 3D cityscape models.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875446</id>
	<title>kdawson nuff said</title>
	<author>slyborg</author>
	<datestamp>1264266180000</datestamp>
	<modclass>Offtopic</modclass>
	<modscore>-1</modscore>
	<htmltext><p>I'd filter the guy, but looks like he posted half the stories today. Seriously,<nobr> <wbr></nobr>/. kind of has jumped the shark a while ago, they are seriously in need of some competition. The laziness level is getting astronomical.</p></htmltext>
<tokenext>I 'd filter the guy , but looks like he posted half the stories today .
Seriously , / .
kind of has jumped the shark a while ago , they are seriously in need of some competition .
The laziness level is getting astronomical .</tokentext>
<sentencetext>I'd filter the guy, but looks like he posted half the stories today.
Seriously, /.
kind of has jumped the shark a while ago, they are seriously in need of some competition.
The laziness level is getting astronomical.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875354</id>
	<title>Data jumps?</title>
	<author>mother\_reincarnated</author>
	<datestamp>1264265160000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Maybe the fact that you put random chunks of data from days apart next to each other has something to do with it?</p></htmltext>
<tokenext>Maybe the fact that you put random chunks of data from days apart next to each other has something to do with it ?</tokentext>
<sentencetext>Maybe the fact that you put random chunks of data from days apart next to each other has something to do with it?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875264</id>
	<title>Privacy concerns - how did you get the data?</title>
	<author>SuperKendall</author>
	<datestamp>1264264440000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Is no-one else bothered by the fact he has access to raw logs from a government system?  Are there no privacy concerns from a private citizen being allowed to scan for users of government system?  For instance, let's imagine it's the local IRS server - he now knows exactly what forms you were downloading, or perhaps visitors to a government site to help people find providers of mental health care.  Really I don't care what the site was, it just seems like there's no valid reason for anyone to have raw data rather than aggregated data outside that department.</p></htmltext>
<tokenext>Is no-one else bothered by the fact he has access to raw logs from a government system ?
Are there no privacy concerns from a private citizen being allowed to scan for users of government system ?
For instance , let 's imagine it 's the local IRS server - he now knows exactly what forms you were downloading , or perhaps visitors to a government site to help people find providers of mental health care .
Really I do n't care what the site was , it just seems like there 's no valid reason for anyone to have raw data rather than aggregated data outside that department .</tokentext>
<sentencetext>Is no-one else bothered by the fact he has access to raw logs from a government system?
Are there no privacy concerns from a private citizen being allowed to scan for users of government system?
For instance, let's imagine it's the local IRS server - he now knows exactly what forms you were downloading, or perhaps visitors to a government site to help people find providers of mental health care.
Really I don't care what the site was, it just seems like there's no valid reason for anyone to have raw data rather than aggregated data outside that department.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874928</id>
	<title>What's going on?</title>
	<author>Blakey Rat</author>
	<datestamp>1264261380000</datestamp>
	<modclass>Offtopic</modclass>
	<modscore>0</modscore>
	<htmltext><p><i>So I made the video of it and I'm asking the Slashdot community: What the heck is going on?</i></p><p>You badly need a new hobby.</p></htmltext>
<tokenext>So I made the video of it and I 'm asking the Slashdot community : What the heck is going on ? You badly need a new hobby .</tokentext>
<sentencetext>So I made the video of it and I'm asking the Slashdot community: What the heck is going on?You badly need a new hobby.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877488</id>
	<title>Couldn't even venture a guess?</title>
	<author>Anonymous</author>
	<datestamp>1264338960000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Simplest explanations are:<br>1) Some distributed botnet is activated to do an attack or a probe.  These may be distributed all around the globe, though some infection vectors are country/language-specific.<br>2) Timezones.  China and India are on the same side of the globe, so people are awake at mainly at the same time.  This might work with previous point: even if a computer is host to malware, it will still turn on and off when the user turns it on and off.<br>3) East-block countries (Romania, Russia, Poland) are famous for their hacker culture.  There are probably dozens of universities full of people motivated to gain notoriety (and future jobs) by probing US agencies.  India, China, Korea probably also.  Literally \_anything\_ can come out of sources like that.</p><p>Peak 100 packets per \_hour\_ is a pitiful amount to base any analysis on.  There may very well be, say, hundred people in India that may ping a well-known US agency to check network connectivity.  Heck, even I sometimes ping "whitehouse.gov" to check "long-distance connectivity."  Ping commands usually send multiple packets, so even it may just be a dozen people or so.  There might even be automated systems that check "network connectivity" by just pinging a few "well-known reliable sites".  Google what cheap routerboxes did with NTP.</p><p>Seeing that you're asking slashdot instead of doing your job, I'll give some suggestions:<br>- Do check out GeoIP.  They have a free database you can download and use to analyze IP addresses (and a commercial one with "more detail"), so you don't need to involve other companies with security data.  You can also get some data by querying whois-databases.<br>- Sort the data somewhat.  If there are 100 countries that don't show any activity, drop them to the end of the list or leave them out totally.  That way you can see the issue at a glance, instead of scrolling around a huge list.<br>- Even if you're allowed only five days worth of data, try to collect more to see if there are any actual trends.<br>- Get a description of the firewall ruleset.  Just saying "packets" might even include legitimate traffic.  Is it all dropped, or some specific ports?  Does it include L7-filtering (analyzing traffic contents, that is)?  Milling ping packets a day don't mean squat, but a thousand invasive IDS-triggering HTTP connections might do.<br>- All of the above, check if you can automate it.  Perl handles pathologically eclectic rubbish listing quite nicely.  After a month or two, you may see if these anomalies are rare at all, or just "business as usual".</p><p>Probably there is nothing you can do about random traffic, even if it's malicious.  If there's clearly malicious traffic from your own country/locale, do inform the companies (and/or the authorities).  The companies might have been breached previously and are unwittingly hosting botnets, and since they get told of it by their own government agency and/or the authorities, they are very likely to do something.</p></htmltext>
<tokenext>Simplest explanations are : 1 ) Some distributed botnet is activated to do an attack or a probe .
These may be distributed all around the globe , though some infection vectors are country/language-specific.2 ) Timezones .
China and India are on the same side of the globe , so people are awake at mainly at the same time .
This might work with previous point : even if a computer is host to malware , it will still turn on and off when the user turns it on and off.3 ) East-block countries ( Romania , Russia , Poland ) are famous for their hacker culture .
There are probably dozens of universities full of people motivated to gain notoriety ( and future jobs ) by probing US agencies .
India , China , Korea probably also .
Literally \ _anything \ _ can come out of sources like that.Peak 100 packets per \ _hour \ _ is a pitiful amount to base any analysis on .
There may very well be , say , hundred people in India that may ping a well-known US agency to check network connectivity .
Heck , even I sometimes ping " whitehouse.gov " to check " long-distance connectivity .
" Ping commands usually send multiple packets , so even it may just be a dozen people or so .
There might even be automated systems that check " network connectivity " by just pinging a few " well-known reliable sites " .
Google what cheap routerboxes did with NTP.Seeing that you 're asking slashdot instead of doing your job , I 'll give some suggestions : - Do check out GeoIP .
They have a free database you can download and use to analyze IP addresses ( and a commercial one with " more detail " ) , so you do n't need to involve other companies with security data .
You can also get some data by querying whois-databases.- Sort the data somewhat .
If there are 100 countries that do n't show any activity , drop them to the end of the list or leave them out totally .
That way you can see the issue at a glance , instead of scrolling around a huge list.- Even if you 're allowed only five days worth of data , try to collect more to see if there are any actual trends.- Get a description of the firewall ruleset .
Just saying " packets " might even include legitimate traffic .
Is it all dropped , or some specific ports ?
Does it include L7-filtering ( analyzing traffic contents , that is ) ?
Milling ping packets a day do n't mean squat , but a thousand invasive IDS-triggering HTTP connections might do.- All of the above , check if you can automate it .
Perl handles pathologically eclectic rubbish listing quite nicely .
After a month or two , you may see if these anomalies are rare at all , or just " business as usual " .Probably there is nothing you can do about random traffic , even if it 's malicious .
If there 's clearly malicious traffic from your own country/locale , do inform the companies ( and/or the authorities ) .
The companies might have been breached previously and are unwittingly hosting botnets , and since they get told of it by their own government agency and/or the authorities , they are very likely to do something .</tokentext>
<sentencetext>Simplest explanations are:1) Some distributed botnet is activated to do an attack or a probe.
These may be distributed all around the globe, though some infection vectors are country/language-specific.2) Timezones.
China and India are on the same side of the globe, so people are awake at mainly at the same time.
This might work with previous point: even if a computer is host to malware, it will still turn on and off when the user turns it on and off.3) East-block countries (Romania, Russia, Poland) are famous for their hacker culture.
There are probably dozens of universities full of people motivated to gain notoriety (and future jobs) by probing US agencies.
India, China, Korea probably also.
Literally \_anything\_ can come out of sources like that.Peak 100 packets per \_hour\_ is a pitiful amount to base any analysis on.
There may very well be, say, hundred people in India that may ping a well-known US agency to check network connectivity.
Heck, even I sometimes ping "whitehouse.gov" to check "long-distance connectivity.
"  Ping commands usually send multiple packets, so even it may just be a dozen people or so.
There might even be automated systems that check "network connectivity" by just pinging a few "well-known reliable sites".
Google what cheap routerboxes did with NTP.Seeing that you're asking slashdot instead of doing your job, I'll give some suggestions:- Do check out GeoIP.
They have a free database you can download and use to analyze IP addresses (and a commercial one with "more detail"), so you don't need to involve other companies with security data.
You can also get some data by querying whois-databases.- Sort the data somewhat.
If there are 100 countries that don't show any activity, drop them to the end of the list or leave them out totally.
That way you can see the issue at a glance, instead of scrolling around a huge list.- Even if you're allowed only five days worth of data, try to collect more to see if there are any actual trends.- Get a description of the firewall ruleset.
Just saying "packets" might even include legitimate traffic.
Is it all dropped, or some specific ports?
Does it include L7-filtering (analyzing traffic contents, that is)?
Milling ping packets a day don't mean squat, but a thousand invasive IDS-triggering HTTP connections might do.- All of the above, check if you can automate it.
Perl handles pathologically eclectic rubbish listing quite nicely.
After a month or two, you may see if these anomalies are rare at all, or just "business as usual".Probably there is nothing you can do about random traffic, even if it's malicious.
If there's clearly malicious traffic from your own country/locale, do inform the companies (and/or the authorities).
The companies might have been breached previously and are unwittingly hosting botnets, and since they get told of it by their own government agency and/or the authorities, they are very likely to do something.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874914</id>
	<title>Obviousness?</title>
	<author>Anonymous</author>
	<datestamp>1264261260000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Could the incoming packets be the result of something sinister... like responses to requests originating from systems inside the unspecified government office?  And when did the first stripe occur, say, 0600 Monday local time?  Honestly, the poster's question fails to address the most obvious questions.  Nice advertisement for Quova and Green Phosphor, though.  Maybe that was the *real* point?<br>
&nbsp; &nbsp;</p></htmltext>
<tokenext>Could the incoming packets be the result of something sinister... like responses to requests originating from systems inside the unspecified government office ?
And when did the first stripe occur , say , 0600 Monday local time ?
Honestly , the poster 's question fails to address the most obvious questions .
Nice advertisement for Quova and Green Phosphor , though .
Maybe that was the * real * point ?
   </tokentext>
<sentencetext>Could the incoming packets be the result of something sinister... like responses to requests originating from systems inside the unspecified government office?
And when did the first stripe occur, say, 0600 Monday local time?
Honestly, the poster's question fails to address the most obvious questions.
Nice advertisement for Quova and Green Phosphor, though.
Maybe that was the *real* point?
   </sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875378</id>
	<title>Who's site?</title>
	<author>Anonymous</author>
	<datestamp>1264265460000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Well gee i wonder... You've got a US Federal Agency, and spikes at certain times of days and from certain nations... it couldn't possibly be botnet/network attacks?</p><p>Nice slasvertisement btw<nobr> <wbr></nobr>//sarcasm</p></htmltext>
<tokenext>Well gee i wonder... You 've got a US Federal Agency , and spikes at certain times of days and from certain nations... it could n't possibly be botnet/network attacks ? Nice slasvertisement btw //sarcasm</tokentext>
<sentencetext>Well gee i wonder... You've got a US Federal Agency, and spikes at certain times of days and from certain nations... it couldn't possibly be botnet/network attacks?Nice slasvertisement btw //sarcasm</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875854</id>
	<title>Translation</title>
	<author>Alex Belits</author>
	<datestamp>1264269780000</datestamp>
	<modclass>Interestin</modclass>
	<modscore>3</modscore>
	<htmltext><p>Vertical stripes may be from spoofed addresses -- nothing from real sources, even botnets, can be that uniform across the whole address space. It would make sense to check how much of traffic comes from unallocated address space, as packets from there are guaranteed to be spoofed. Why would anyone do such a thing? As a direct portscan it would be useless (he can't see the responses), however it might be used as a smokescreen to hide a real portscan or attack from some of those addresses. It may even be an attack that floods the DNS servers with fake responses in the attempt to poison DNS cache, thus redirecting some of the traffic to the attackers' addresses.</p><p>Then, after whatever kind of discovery was completed, you have seen some targeted host scans, [D]DoS attempts or actual exploits causing large amount of traffic (horizontal stripes).</p><p>Another possibility is that those packets are responses caused by something on your network being coerced into sending packets uniformly to the whole address space. It may be something as stupid as a web page with random redirects, however more likely it is a worm on some of your computers looking for other members of his botnet. After such discovery some hosts joined the botnet[s], producing horizontal stripes composed of traffic from other botnet members.</p></htmltext>
<tokenext>Vertical stripes may be from spoofed addresses -- nothing from real sources , even botnets , can be that uniform across the whole address space .
It would make sense to check how much of traffic comes from unallocated address space , as packets from there are guaranteed to be spoofed .
Why would anyone do such a thing ?
As a direct portscan it would be useless ( he ca n't see the responses ) , however it might be used as a smokescreen to hide a real portscan or attack from some of those addresses .
It may even be an attack that floods the DNS servers with fake responses in the attempt to poison DNS cache , thus redirecting some of the traffic to the attackers ' addresses.Then , after whatever kind of discovery was completed , you have seen some targeted host scans , [ D ] DoS attempts or actual exploits causing large amount of traffic ( horizontal stripes ) .Another possibility is that those packets are responses caused by something on your network being coerced into sending packets uniformly to the whole address space .
It may be something as stupid as a web page with random redirects , however more likely it is a worm on some of your computers looking for other members of his botnet .
After such discovery some hosts joined the botnet [ s ] , producing horizontal stripes composed of traffic from other botnet members .</tokentext>
<sentencetext>Vertical stripes may be from spoofed addresses -- nothing from real sources, even botnets, can be that uniform across the whole address space.
It would make sense to check how much of traffic comes from unallocated address space, as packets from there are guaranteed to be spoofed.
Why would anyone do such a thing?
As a direct portscan it would be useless (he can't see the responses), however it might be used as a smokescreen to hide a real portscan or attack from some of those addresses.
It may even be an attack that floods the DNS servers with fake responses in the attempt to poison DNS cache, thus redirecting some of the traffic to the attackers' addresses.Then, after whatever kind of discovery was completed, you have seen some targeted host scans, [D]DoS attempts or actual exploits causing large amount of traffic (horizontal stripes).Another possibility is that those packets are responses caused by something on your network being coerced into sending packets uniformly to the whole address space.
It may be something as stupid as a web page with random redirects, however more likely it is a worm on some of your computers looking for other members of his botnet.
After such discovery some hosts joined the botnet[s], producing horizontal stripes composed of traffic from other botnet members.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875274</id>
	<title>Naughty Country IP list</title>
	<author>EmperorOfCanada</author>
	<datestamp>1264264500000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely?</htmltext>
<tokenext>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely ?</tokentext>
<sentencetext>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766</id>
	<title>Skylab Shreds</title>
	<author>Anonymous</author>
	<datestamp>1264260300000</datestamp>
	<modclass>Funny</modclass>
	<modscore>5</modscore>
	<htmltext><p>Not sure what it means, but I'm tempted to plug-in Guitar Hero and jam along to your firewall logs.</p></htmltext>
<tokenext>Not sure what it means , but I 'm tempted to plug-in Guitar Hero and jam along to your firewall logs .</tokentext>
<sentencetext>Not sure what it means, but I'm tempted to plug-in Guitar Hero and jam along to your firewall logs.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874846</id>
	<title>botnet.</title>
	<author>Anonymous</author>
	<datestamp>1264260840000</datestamp>
	<modclass>Interestin</modclass>
	<modscore>1</modscore>
	<htmltext><p>The striping across all countries is a check whether your site is reachable from that part of the botnet, the purpose of the traffic is unclear; either to do a large data grab or it's a (very unsuccessful) bandwidth attack, or something. You should adjust it for <a href="http://www.internetworldstats.com/top20.htm" title="internetworldstats.com" rel="nofollow">number of internet connected users</a> [internetworldstats.com] per country first then revisualize that.</p></htmltext>
<tokenext>The striping across all countries is a check whether your site is reachable from that part of the botnet , the purpose of the traffic is unclear ; either to do a large data grab or it 's a ( very unsuccessful ) bandwidth attack , or something .
You should adjust it for number of internet connected users [ internetworldstats.com ] per country first then revisualize that .</tokentext>
<sentencetext>The striping across all countries is a check whether your site is reachable from that part of the botnet, the purpose of the traffic is unclear; either to do a large data grab or it's a (very unsuccessful) bandwidth attack, or something.
You should adjust it for number of internet connected users [internetworldstats.com] per country first then revisualize that.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875388</id>
	<title>It means...</title>
	<author>Baloo Uriza</author>
	<datestamp>1264265580000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>... you should hire someone who knows what they're doing, and/or quit acting like <a href="http://www.youtube.com/watch?v=dFUlAQZB9Ng" title="youtube.com" rel="nofollow">the kids from Jurassic Park</a> [youtube.com].  Pretty pictures alone don't tell the whole story in the real world.</htmltext>
<tokenext>... you should hire someone who knows what they 're doing , and/or quit acting like the kids from Jurassic Park [ youtube.com ] .
Pretty pictures alone do n't tell the whole story in the real world .</tokentext>
<sentencetext>... you should hire someone who knows what they're doing, and/or quit acting like the kids from Jurassic Park [youtube.com].
Pretty pictures alone don't tell the whole story in the real world.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820</id>
	<title>vertical stripes</title>
	<author>Anonymous</author>
	<datestamp>1264260660000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>I'm actually a lot more interested in the vertical stripes than the horizontal ones.  It looks like at certain times, every country in the world sends a packet . .</htmltext>
<tokenext>I 'm actually a lot more interested in the vertical stripes than the horizontal ones .
It looks like at certain times , every country in the world sends a packet .
.</tokentext>
<sentencetext>I'm actually a lot more interested in the vertical stripes than the horizontal ones.
It looks like at certain times, every country in the world sends a packet .
.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876410</id>
	<title>What!</title>
	<author>Korbeau</author>
	<datestamp>1264276740000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>He finds it surprising that people actually look at government websites?</p><p>I find it surprising too!<nobr> <wbr></nobr>:)</p></htmltext>
<tokenext>He finds it surprising that people actually look at government websites ? I find it surprising too !
: )</tokentext>
<sentencetext>He finds it surprising that people actually look at government websites?I find it surprising too!
:)</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875808</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>Anonymous</author>
	<datestamp>1264269480000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Not to mention that the numbers in the bottom graph don't seem to be evenly spaced. It goes from 2009-09-16hr11 to 2009-09-16hr15 to 2009-09-28hr00, all about the same distance apart. WTF? In what date system does *that* make sense?</p></htmltext>
<tokenext>Not to mention that the numbers in the bottom graph do n't seem to be evenly spaced .
It goes from 2009-09-16hr11 to 2009-09-16hr15 to 2009-09-28hr00 , all about the same distance apart .
WTF ? In what date system does * that * make sense ?</tokentext>
<sentencetext>Not to mention that the numbers in the bottom graph don't seem to be evenly spaced.
It goes from 2009-09-16hr11 to 2009-09-16hr15 to 2009-09-28hr00, all about the same distance apart.
WTF? In what date system does *that* make sense?</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875226</id>
	<title>Re:Why am I worried?</title>
	<author>krej</author>
	<datestamp>1264264080000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>I was wondering the same thing. Why do you have access to government logs yet don't have a better way to figure out what it is than ask on slashdot?</htmltext>
<tokenext>I was wondering the same thing .
Why do you have access to government logs yet do n't have a better way to figure out what it is than ask on slashdot ?</tokentext>
<sentencetext>I was wondering the same thing.
Why do you have access to government logs yet don't have a better way to figure out what it is than ask on slashdot?</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840</id>
	<title>Another Slashdot Ad?</title>
	<author>Anonymous</author>
	<datestamp>1264260780000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>5</modscore>
	<htmltext><p>Wait, is this just an advertisement for Glasshouse?  The voice in the video on Green Phosphor's website is exactly the same.</p><p>What gives?</p></htmltext>
<tokenext>Wait , is this just an advertisement for Glasshouse ?
The voice in the video on Green Phosphor 's website is exactly the same.What gives ?</tokentext>
<sentencetext>Wait, is this just an advertisement for Glasshouse?
The voice in the video on Green Phosphor's website is exactly the same.What gives?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944</id>
	<title>"And its freaking crazy looking"</title>
	<author>PCM2</author>
	<datestamp>1264261560000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>5</modscore>
	<htmltext><p>Am I the only one who found the five minutes of this video to be about as interesting as listening to a stoned person describe the cracks on the ceiling?</p><p><i>You</i> designed the visualization, buddy. If it's "freaking crazy looking," rather than yielding any useful insight, then obviously you did not visualize it in a meaningful way. You failed, in other words.</p><p>But as an earlier poster noted, this is just a Slashvertisement for the visualization tool in question. No doubt it will be quite effective on the kind of people who talk as slowly as the guy in the video.</p></htmltext>
<tokenext>Am I the only one who found the five minutes of this video to be about as interesting as listening to a stoned person describe the cracks on the ceiling ? You designed the visualization , buddy .
If it 's " freaking crazy looking , " rather than yielding any useful insight , then obviously you did not visualize it in a meaningful way .
You failed , in other words.But as an earlier poster noted , this is just a Slashvertisement for the visualization tool in question .
No doubt it will be quite effective on the kind of people who talk as slowly as the guy in the video .</tokentext>
<sentencetext>Am I the only one who found the five minutes of this video to be about as interesting as listening to a stoned person describe the cracks on the ceiling?You designed the visualization, buddy.
If it's "freaking crazy looking," rather than yielding any useful insight, then obviously you did not visualize it in a meaningful way.
You failed, in other words.But as an earlier poster noted, this is just a Slashvertisement for the visualization tool in question.
No doubt it will be quite effective on the kind of people who talk as slowly as the guy in the video.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875312</id>
	<title>It's the people avoiding patterns to fear.</title>
	<author>955301</author>
	<datestamp>1264264800000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>This just doesn't seem like a big deal. The countries he points out are all in the same timezones so it's probably just their normal day starting. So this probably correlates to dns refresh or some other aspect (vertical) of general internet operations landing on the same hour.</p><p>He needs tcp port analysis and to compare days - the pattern is probably the same from day to day.</p></htmltext>
<tokenext>This just does n't seem like a big deal .
The countries he points out are all in the same timezones so it 's probably just their normal day starting .
So this probably correlates to dns refresh or some other aspect ( vertical ) of general internet operations landing on the same hour.He needs tcp port analysis and to compare days - the pattern is probably the same from day to day .</tokentext>
<sentencetext>This just doesn't seem like a big deal.
The countries he points out are all in the same timezones so it's probably just their normal day starting.
So this probably correlates to dns refresh or some other aspect (vertical) of general internet operations landing on the same hour.He needs tcp port analysis and to compare days - the pattern is probably the same from day to day.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875562</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>noidentity</author>
	<datestamp>1264267500000</datestamp>
	<modclass>Funny</modclass>
	<modscore>3</modscore>
	<htmltext>Maybe you could do a visualization of this guy's astroturfing. And for some reason it seems highly appropriate to use his own visualization tools for it. The ad demonstrating the product would be based on everywhere the ad itself had been spammed. I love it.</htmltext>
<tokenext>Maybe you could do a visualization of this guy 's astroturfing .
And for some reason it seems highly appropriate to use his own visualization tools for it .
The ad demonstrating the product would be based on everywhere the ad itself had been spammed .
I love it .</tokentext>
<sentencetext>Maybe you could do a visualization of this guy's astroturfing.
And for some reason it seems highly appropriate to use his own visualization tools for it.
The ad demonstrating the product would be based on everywhere the ad itself had been spammed.
I love it.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875906</id>
	<title>Re:"And its freaking crazy looking"</title>
	<author>Anonymous</author>
	<datestamp>1264270260000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p><div class="quote"><p>Am I the only one who found the five minutes of this video to be about as interesting as listening to a stoned person describe the cracks on the ceiling?</p></div><p>Hey, at least it is better than NASAs videos / live streams, right?<br>Boy, they sure know how to bore even the scientist in me.</p></div>
	</htmltext>
<tokenext>Am I the only one who found the five minutes of this video to be about as interesting as listening to a stoned person describe the cracks on the ceiling ? Hey , at least it is better than NASAs videos / live streams , right ? Boy , they sure know how to bore even the scientist in me .</tokentext>
<sentencetext>Am I the only one who found the five minutes of this video to be about as interesting as listening to a stoned person describe the cracks on the ceiling?Hey, at least it is better than NASAs videos / live streams, right?Boy, they sure know how to bore even the scientist in me.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874804</id>
	<title>Well duh!</title>
	<author>Anonymous</author>
	<datestamp>1264260540000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>It's the Chinese HACKERS!</p></htmltext>
<tokenext>It 's the Chinese HACKERS !</tokentext>
<sentencetext>It's the Chinese HACKERS!</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875346</id>
	<title>What a let down</title>
	<author>Aoet\_325</author>
	<datestamp>1264265100000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>I normally I'd love this sort of thing. I pour over logs in my spare time - for kicks even, but this video just bored me. For nearly half the video this thing never goes beyond "look! people in different countries are active at different times!".</p><p>Even the few things that almost start to seem interesting leave you unable to gain any insight because there is just no information. There isn't any useful data to work with.</p><p>What this fails to provide us with is what kind of traffic this was in the first place. Any reasonably large site is going to get hit with all kinds of background noise, and so the fact that they found themselves with large amounts of "traffic" from 'nearly every country' doesn't surprise me.</p><p>This seems to be nothing more than an example of a very dull and uninformative way to display a large collection something very very common.</p></htmltext>
<tokenext>I normally I 'd love this sort of thing .
I pour over logs in my spare time - for kicks even , but this video just bored me .
For nearly half the video this thing never goes beyond " look !
people in different countries are active at different times !
" .Even the few things that almost start to seem interesting leave you unable to gain any insight because there is just no information .
There is n't any useful data to work with.What this fails to provide us with is what kind of traffic this was in the first place .
Any reasonably large site is going to get hit with all kinds of background noise , and so the fact that they found themselves with large amounts of " traffic " from 'nearly every country ' does n't surprise me.This seems to be nothing more than an example of a very dull and uninformative way to display a large collection something very very common .</tokentext>
<sentencetext>I normally I'd love this sort of thing.
I pour over logs in my spare time - for kicks even, but this video just bored me.
For nearly half the video this thing never goes beyond "look!
people in different countries are active at different times!
".Even the few things that almost start to seem interesting leave you unable to gain any insight because there is just no information.
There isn't any useful data to work with.What this fails to provide us with is what kind of traffic this was in the first place.
Any reasonably large site is going to get hit with all kinds of background noise, and so the fact that they found themselves with large amounts of "traffic" from 'nearly every country' doesn't surprise me.This seems to be nothing more than an example of a very dull and uninformative way to display a large collection something very very common.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874872</id>
	<title>My guess</title>
	<author>JoshuaZ</author>
	<datestamp>1264260960000</datestamp>
	<modclass>Interestin</modclass>
	<modscore>2</modscore>
	<htmltext>It looks to me like the lines of major activity likely corresponded to major news events or other events that caused people to look at the relevant government agency. Without more data it is difficult to speculate. It might be possible to look at the approximate date (Early September of 2009) and find a specific event that would cause this. Indeed, it might then be possible to actually make a guess as to what government agency the firewall belonged.</htmltext>
<tokenext>It looks to me like the lines of major activity likely corresponded to major news events or other events that caused people to look at the relevant government agency .
Without more data it is difficult to speculate .
It might be possible to look at the approximate date ( Early September of 2009 ) and find a specific event that would cause this .
Indeed , it might then be possible to actually make a guess as to what government agency the firewall belonged .</tokentext>
<sentencetext>It looks to me like the lines of major activity likely corresponded to major news events or other events that caused people to look at the relevant government agency.
Without more data it is difficult to speculate.
It might be possible to look at the approximate date (Early September of 2009) and find a specific event that would cause this.
Indeed, it might then be possible to actually make a guess as to what government agency the firewall belonged.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875424</id>
	<title>Re:vertical stripes</title>
	<author>golden age villain</author>
	<datestamp>1264265940000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>I thought exactly about the same thing. It would be useful though to have a longer time stretch to see if the pattern is meaningful or if it periodically repeats over days, weeks or months.</htmltext>
<tokenext>I thought exactly about the same thing .
It would be useful though to have a longer time stretch to see if the pattern is meaningful or if it periodically repeats over days , weeks or months .</tokentext>
<sentencetext>I thought exactly about the same thing.
It would be useful though to have a longer time stretch to see if the pattern is meaningful or if it periodically repeats over days, weeks or months.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108</id>
	<title>Re:"And its freaking crazy looking"</title>
	<author>Eightbitgnosis</author>
	<datestamp>1264262940000</datestamp>
	<modclass>Troll</modclass>
	<modscore>0</modscore>
	<htmltext>I read the author and learned a little about network usage patterns and how to look at them. I read your post and saw a lot of complaining. Point goes to the original author</htmltext>
<tokenext>I read the author and learned a little about network usage patterns and how to look at them .
I read your post and saw a lot of complaining .
Point goes to the original author</tokentext>
<sentencetext>I read the author and learned a little about network usage patterns and how to look at them.
I read your post and saw a lot of complaining.
Point goes to the original author</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875240</id>
	<title>Re:"And its freaking crazy looking"</title>
	<author>Anonymous</author>
	<datestamp>1264264200000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p><div class="quote"><p>rather than yielding any useful insight, then obviously you did not visualize it in a meaningful way. You failed, in other words.</p></div><p>Here's another example of another <a href="http://www.youtube.com/watch?v=t849CYRd2Ak" title="youtube.com" rel="nofollow">cyber security fail</a> [youtube.com].</p></div>
	</htmltext>
<tokenext>rather than yielding any useful insight , then obviously you did not visualize it in a meaningful way .
You failed , in other words.Here 's another example of another cyber security fail [ youtube.com ] .</tokentext>
<sentencetext>rather than yielding any useful insight, then obviously you did not visualize it in a meaningful way.
You failed, in other words.Here's another example of another cyber security fail [youtube.com].
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877118</id>
	<title>Re:Skylab Shreds</title>
	<author>HybridJeff</author>
	<datestamp>1264332360000</datestamp>
	<modclass>Informativ</modclass>
	<modscore>4</modscore>
	<htmltext>The graph is kind of misleading, its not actually to scale and its not showing the 5 days he claims in the youtube description.

Go to around the 3:05 mark and watch the time stamp when he mouses over Romania. On the far right you can see an early date of 2009-09-15, as he scrolls to the right we can see a date of  2009-09-28 at the second stripe which is roughly in the middle of the graph, continuing on the far right hand side portion of the graph is dated 2009-09-30.

The left hand side of the graph shows results over the span of 13 days and the right hand side taking up the same visual space only shows 2-3 days. Basically I just wasted 15 minutes looking over worthless data on a random youtube video that doesn't actually say anything.</htmltext>
<tokenext>The graph is kind of misleading , its not actually to scale and its not showing the 5 days he claims in the youtube description .
Go to around the 3 : 05 mark and watch the time stamp when he mouses over Romania .
On the far right you can see an early date of 2009-09-15 , as he scrolls to the right we can see a date of 2009-09-28 at the second stripe which is roughly in the middle of the graph , continuing on the far right hand side portion of the graph is dated 2009-09-30 .
The left hand side of the graph shows results over the span of 13 days and the right hand side taking up the same visual space only shows 2-3 days .
Basically I just wasted 15 minutes looking over worthless data on a random youtube video that does n't actually say anything .</tokentext>
<sentencetext>The graph is kind of misleading, its not actually to scale and its not showing the 5 days he claims in the youtube description.
Go to around the 3:05 mark and watch the time stamp when he mouses over Romania.
On the far right you can see an early date of 2009-09-15, as he scrolls to the right we can see a date of  2009-09-28 at the second stripe which is roughly in the middle of the graph, continuing on the far right hand side portion of the graph is dated 2009-09-30.
The left hand side of the graph shows results over the span of 13 days and the right hand side taking up the same visual space only shows 2-3 days.
Basically I just wasted 15 minutes looking over worthless data on a random youtube video that doesn't actually say anything.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875992</id>
	<title>Re:Great ways to start a conversation</title>
	<author>Anonymous</author>
	<datestamp>1264271160000</datestamp>
	<modclass>Funny</modclass>
	<modscore>2</modscore>
	<htmltext>I want to be your friend.</htmltext>
<tokenext>I want to be your friend .</tokentext>
<sentencetext>I want to be your friend.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875140</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876290</id>
	<title>my brain hurts...</title>
	<author>Anonymous</author>
	<datestamp>1264274940000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>... from the retarded question..</p><p>my guess.. state is a multinational organization with several different employees logging in from different embassies all over the world.. multiply that by the fact that these employees surf local sites (remember there are hundreds at each site) then combine that with the usual suspects that will attack a us network any way they can.. yeah this is normal firewall activity.</p><p>PS the graph sucks, and doesn't provide any real detail.. throw it out in a parseable database and i'm good... state uses splunk.... any anyone who is smart would use a NORMAL log parsing utility.. graphs are pretty for managers techs use stuff they can read and parse</p></htmltext>
<tokenext>... from the retarded question..my guess.. state is a multinational organization with several different employees logging in from different embassies all over the world.. multiply that by the fact that these employees surf local sites ( remember there are hundreds at each site ) then combine that with the usual suspects that will attack a us network any way they can.. yeah this is normal firewall activity.PS the graph sucks , and does n't provide any real detail.. throw it out in a parseable database and i 'm good... state uses splunk.... any anyone who is smart would use a NORMAL log parsing utility.. graphs are pretty for managers techs use stuff they can read and parse</tokentext>
<sentencetext>... from the retarded question..my guess.. state is a multinational organization with several different employees logging in from different embassies all over the world.. multiply that by the fact that these employees surf local sites (remember there are hundreds at each site) then combine that with the usual suspects that will attack a us network any way they can.. yeah this is normal firewall activity.PS the graph sucks, and doesn't provide any real detail.. throw it out in a parseable database and i'm good... state uses splunk.... any anyone who is smart would use a NORMAL log parsing utility.. graphs are pretty for managers techs use stuff they can read and parse</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30880962</id>
	<title>Romania</title>
	<author>vacarul</author>
	<datestamp>1264364160000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>if it's Romania in there, it's BitTorrent.<br>
<br>
Dugg for Romania!<br>
<br>
oh wait...</htmltext>
<tokenext>if it 's Romania in there , it 's BitTorrent .
Dugg for Romania !
oh wait.. .</tokentext>
<sentencetext>if it's Romania in there, it's BitTorrent.
Dugg for Romania!
oh wait...</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876098</id>
	<title>Increased traffic...</title>
	<author>sleeping143</author>
	<datestamp>1264272480000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>I think it's safe to say the traffic spikes, especially from asia and the south pacific, is due to the tsunami that hit. <a href="http://en.wikipedia.org/wiki/2009\_Samoa\_earthquake" title="wikipedia.org" rel="nofollow">http://en.wikipedia.org/wiki/2009\_Samoa\_earthquake</a> [wikipedia.org]</htmltext>
<tokenext>I think it 's safe to say the traffic spikes , especially from asia and the south pacific , is due to the tsunami that hit .
http : //en.wikipedia.org/wiki/2009 \ _Samoa \ _earthquake [ wikipedia.org ]</tokentext>
<sentencetext>I think it's safe to say the traffic spikes, especially from asia and the south pacific, is due to the tsunami that hit.
http://en.wikipedia.org/wiki/2009\_Samoa\_earthquake [wikipedia.org]</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878178</id>
	<title>Re:vertical stripes</title>
	<author>Anonymous</author>
	<datestamp>1264348020000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>300 packets, per second i assume, from a whole country is hardly ddos for any site of a decent size.</p></htmltext>
<tokenext>300 packets , per second i assume , from a whole country is hardly ddos for any site of a decent size .</tokentext>
<sentencetext>300 packets, per second i assume, from a whole country is hardly ddos for any site of a decent size.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876004</id>
	<title>Re:Naughty Country IP list</title>
	<author>fluffy99</author>
	<datestamp>1264271340000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely?</p></div><p>Google can tell you within minutes what IPs ranges correspond to non-US locations.  Here's one such list that's reasonably close. <a href="http://www.experts-exchange.com/Networking/Misc/Q\_21787352.html" title="experts-exchange.com">http://www.experts-exchange.com/Networking/Misc/Q\_21787352.html</a> [experts-exchange.com].  You should also be blocking bogons (address that you shouldn't see on the internet such as unassigned ranges) <a href="http://www.cymru.com/Documents/bogon-list.html" title="cymru.com">http://www.cymru.com/Documents/bogon-list.html</a> [cymru.com].</p><p>Keep in mind that blocking all foreign IPs isn't foolproof as some US clients may still end up going through a foreign relay or some sort of proxy.  Also systems compromised by foreign adversaries or foreign controlled botnets will be seen coming from within the US.  I block all non-US addresses, bogons, a few problematic US ISP ranges, and a select list of other subnets based on previous attacks. The company I work for also maintains a very large list of addresses to black-hole (both in and out) based on other information such as previous attacks or IPs controlled by foreign companies.  Outgoing traffic to specific addresses triggers red flags for potentially compromised systems.</p></div>
	</htmltext>
<tokenext>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely ? Google can tell you within minutes what IPs ranges correspond to non-US locations .
Here 's one such list that 's reasonably close .
http : //www.experts-exchange.com/Networking/Misc/Q \ _21787352.html [ experts-exchange.com ] .
You should also be blocking bogons ( address that you should n't see on the internet such as unassigned ranges ) http : //www.cymru.com/Documents/bogon-list.html [ cymru.com ] .Keep in mind that blocking all foreign IPs is n't foolproof as some US clients may still end up going through a foreign relay or some sort of proxy .
Also systems compromised by foreign adversaries or foreign controlled botnets will be seen coming from within the US .
I block all non-US addresses , bogons , a few problematic US ISP ranges , and a select list of other subnets based on previous attacks .
The company I work for also maintains a very large list of addresses to black-hole ( both in and out ) based on other information such as previous attacks or IPs controlled by foreign companies .
Outgoing traffic to specific addresses triggers red flags for potentially compromised systems .</tokentext>
<sentencetext>Where can one get a list of IP addresses for countries like China and India so that server admins like myself can block these countries entirely?Google can tell you within minutes what IPs ranges correspond to non-US locations.
Here's one such list that's reasonably close.
http://www.experts-exchange.com/Networking/Misc/Q\_21787352.html [experts-exchange.com].
You should also be blocking bogons (address that you shouldn't see on the internet such as unassigned ranges) http://www.cymru.com/Documents/bogon-list.html [cymru.com].Keep in mind that blocking all foreign IPs isn't foolproof as some US clients may still end up going through a foreign relay or some sort of proxy.
Also systems compromised by foreign adversaries or foreign controlled botnets will be seen coming from within the US.
I block all non-US addresses, bogons, a few problematic US ISP ranges, and a select list of other subnets based on previous attacks.
The company I work for also maintains a very large list of addresses to black-hole (both in and out) based on other information such as previous attacks or IPs controlled by foreign companies.
Outgoing traffic to specific addresses triggers red flags for potentially compromised systems.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875274</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876188</id>
	<title>Re:Looks like a sneaky ad to me.</title>
	<author>osu-neko</author>
	<datestamp>1264273440000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>Any competent programmer could have sampled the data, used whois to get location, and then used about 1000 different programs to visualize the data just as well. (Like Crystal Reports or Seagate.)</p></div><p>How do you use whois to get the geographic location of an IP address?  I know how to get the mailing address of a registrant this way, but that's an utterly unrelated question...</p></div>
	</htmltext>
<tokenext>Any competent programmer could have sampled the data , used whois to get location , and then used about 1000 different programs to visualize the data just as well .
( Like Crystal Reports or Seagate .
) How do you use whois to get the geographic location of an IP address ?
I know how to get the mailing address of a registrant this way , but that 's an utterly unrelated question.. .</tokentext>
<sentencetext>Any competent programmer could have sampled the data, used whois to get location, and then used about 1000 different programs to visualize the data just as well.
(Like Crystal Reports or Seagate.
)How do you use whois to get the geographic location of an IP address?
I know how to get the mailing address of a registrant this way, but that's an utterly unrelated question...
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875318</id>
	<title>What I'm wondering....</title>
	<author>Anonymous</author>
	<datestamp>1264264860000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>...is when the FBI kicks his doors in for posting about firewall info from a US government org on slashdot, with videos on youtube.</p></htmltext>
<tokenext>...is when the FBI kicks his doors in for posting about firewall info from a US government org on slashdot , with videos on youtube .</tokentext>
<sentencetext>...is when the FBI kicks his doors in for posting about firewall info from a US government org on slashdot, with videos on youtube.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874924</id>
	<title>My guess-Paint by Packet</title>
	<author>Anonymous</author>
	<datestamp>1264261320000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>What kind of packets would be nice?</p></htmltext>
<tokenext>What kind of packets would be nice ?</tokentext>
<sentencetext>What kind of packets would be nice?</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874872</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30902158</id>
	<title>bad data, bad visualization, idiot person</title>
	<author>Anonymous</author>
	<datestamp>1264507500000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Bad data = Bad visualization = stupid advert<br>if you watch the labels closely as he moves the mouse around you notice this that there is are ten days of missing data in the middle - exactly where the first vertical stripe appears (2009-09-27 hr:20) - which means that he is an idiot for joining two disjoint data sets: the one without the stripes and the one with the stripes.</p><p>Basically at the left side it starts with: 2009-09-14 hr:22, goes to 2009-09-16 hr:19 and SUDDENLY jumps to 2009-09-27 hr:20 and than smooth to 2009-09-30 hr:03 till the end</p><p>IDIOT !<br>IDIOT !<br>IDIOT !</p></htmltext>
<tokenext>Bad data = Bad visualization = stupid advertif you watch the labels closely as he moves the mouse around you notice this that there is are ten days of missing data in the middle - exactly where the first vertical stripe appears ( 2009-09-27 hr : 20 ) - which means that he is an idiot for joining two disjoint data sets : the one without the stripes and the one with the stripes.Basically at the left side it starts with : 2009-09-14 hr : 22 , goes to 2009-09-16 hr : 19 and SUDDENLY jumps to 2009-09-27 hr : 20 and than smooth to 2009-09-30 hr : 03 till the endIDIOT ! IDIOT ! IDIOT !</tokentext>
<sentencetext>Bad data = Bad visualization = stupid advertif you watch the labels closely as he moves the mouse around you notice this that there is are ten days of missing data in the middle - exactly where the first vertical stripe appears (2009-09-27 hr:20) - which means that he is an idiot for joining two disjoint data sets: the one without the stripes and the one with the stripes.Basically at the left side it starts with: 2009-09-14 hr:22, goes to 2009-09-16 hr:19 and SUDDENLY jumps to 2009-09-27 hr:20 and than smooth to 2009-09-30 hr:03 till the endIDIOT !IDIOT !IDIOT !</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876268</id>
	<title>2 possibilities</title>
	<author>ILuvRamen</author>
	<datestamp>1264274640000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Everyone wants to think botnet but I have a second theory that's kinda out there.  Maybe it's Google's international search engine robot servers all hitting it on a schedule to update their indexes.  Why they'd be that synchronized I don't know for sure though.  Maybe the google master controls decide it's time to update that website's index and it doesn't want the UK's google to show something 2 days later than the US version or people might find out and bitch about second rate service for their country so they signal all the robot servers everywhere to hit it at once.</htmltext>
<tokenext>Everyone wants to think botnet but I have a second theory that 's kinda out there .
Maybe it 's Google 's international search engine robot servers all hitting it on a schedule to update their indexes .
Why they 'd be that synchronized I do n't know for sure though .
Maybe the google master controls decide it 's time to update that website 's index and it does n't want the UK 's google to show something 2 days later than the US version or people might find out and bitch about second rate service for their country so they signal all the robot servers everywhere to hit it at once .</tokentext>
<sentencetext>Everyone wants to think botnet but I have a second theory that's kinda out there.
Maybe it's Google's international search engine robot servers all hitting it on a schedule to update their indexes.
Why they'd be that synchronized I don't know for sure though.
Maybe the google master controls decide it's time to update that website's index and it doesn't want the UK's google to show something 2 days later than the US version or people might find out and bitch about second rate service for their country so they signal all the robot servers everywhere to hit it at once.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30882956</id>
	<title>Re:Translation</title>
	<author>Anonymous</author>
	<datestamp>1264332420000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>How about it was data from the 15th and 16th that was the "quiet" period, and the remaining "hours" beginning with the so called "21st" hour was from the 27th, 28th and 29th.<br>The "21st" hour was not the magical beginning of any attack. Just made for a nice looking graph to "show" what an attack might look like.</p><p>If I had to guess, over those 15 days the "attack" very very slowly ramped up to the levels shown.  There was no magical horizontal stripe. And low and behold the whole thing is a slashvertisement also...</p></htmltext>
<tokenext>How about it was data from the 15th and 16th that was the " quiet " period , and the remaining " hours " beginning with the so called " 21st " hour was from the 27th , 28th and 29th.The " 21st " hour was not the magical beginning of any attack .
Just made for a nice looking graph to " show " what an attack might look like.If I had to guess , over those 15 days the " attack " very very slowly ramped up to the levels shown .
There was no magical horizontal stripe .
And low and behold the whole thing is a slashvertisement also.. .</tokentext>
<sentencetext>How about it was data from the 15th and 16th that was the "quiet" period, and the remaining "hours" beginning with the so called "21st" hour was from the 27th, 28th and 29th.The "21st" hour was not the magical beginning of any attack.
Just made for a nice looking graph to "show" what an attack might look like.If I had to guess, over those 15 days the "attack" very very slowly ramped up to the levels shown.
There was no magical horizontal stripe.
And low and behold the whole thing is a slashvertisement also...</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875854</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874830</id>
	<title>Finally</title>
	<author>Anonymous</author>
	<datestamp>1264260720000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Somebody who doesn't forgets Poland.</p><p>(even if traffic from there wasn't unusual in any way)</p></htmltext>
<tokenext>Somebody who does n't forgets Poland .
( even if traffic from there was n't unusual in any way )</tokentext>
<sentencetext>Somebody who doesn't forgets Poland.
(even if traffic from there wasn't unusual in any way)</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877332</id>
	<title>What about outbound packets ?</title>
	<author>Alain Williams</author>
	<datestamp>1264336140000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>It could be something on the govt agency's computers connecting <b>out</b> at certain times and what we see are the reply packets coming back in. Maybe one of their own cron jobs.<p>
Without a whole bunch of more information we are guessing in the dark:
</p><ul>
<li>What agency ?</li>
<li>What sort of packages ? UDP/TCP/ICMP ? What port numbers ?</li>
<li>The remote addresses: are they the same ones all the time, or a much smaller set ?</li>
<li>The local addresses: how many are these packets being sent to ?</li>
<li>Correlate protocol and IP address</li>
</ul><p>
Until we know more -- it is not worth spending time on this.</p></htmltext>
<tokenext>It could be something on the govt agency 's computers connecting out at certain times and what we see are the reply packets coming back in .
Maybe one of their own cron jobs .
Without a whole bunch of more information we are guessing in the dark : What agency ?
What sort of packages ?
UDP/TCP/ICMP ?
What port numbers ?
The remote addresses : are they the same ones all the time , or a much smaller set ?
The local addresses : how many are these packets being sent to ?
Correlate protocol and IP address Until we know more -- it is not worth spending time on this .</tokentext>
<sentencetext>It could be something on the govt agency's computers connecting out at certain times and what we see are the reply packets coming back in.
Maybe one of their own cron jobs.
Without a whole bunch of more information we are guessing in the dark:

What agency ?
What sort of packages ?
UDP/TCP/ICMP ?
What port numbers ?
The remote addresses: are they the same ones all the time, or a much smaller set ?
The local addresses: how many are these packets being sent to ?
Correlate protocol and IP address

Until we know more -- it is not worth spending time on this.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874786</id>
	<title>re Firewall?</title>
	<author>Anonymous</author>
	<datestamp>1264260420000</datestamp>
	<modclass>Offtopic</modclass>
	<modscore>-1</modscore>
	<htmltext><p><div class="quote"><p>Crazy Firewall Log Activity &mdash; What Does It Mean?</p></div><p>Maybe it is the Great Firewall of China?</p></div>
	</htmltext>
<tokenext>Crazy Firewall Log Activity    What Does It Mean ? Maybe it is the Great Firewall of China ?</tokentext>
<sentencetext>Crazy Firewall Log Activity — What Does It Mean?Maybe it is the Great Firewall of China?
	</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874864</id>
	<title>mod Do3n</title>
	<author>Anonymous</author>
	<datestamp>1264260900000</datestamp>
	<modclass>Troll</modclass>
	<modscore>-1</modscore>
	<htmltext><A HREF="http://goat.cx/" title="goat.cx" rel="nofollow">trouble. It pre0viously thought again. There are</a> [goat.cx]</htmltext>
<tokenext>trouble .
It pre0viously thought again .
There are [ goat.cx ]</tokentext>
<sentencetext>trouble.
It pre0viously thought again.
There are [goat.cx]</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878058</id>
	<title>Skyrails makes this look terrible</title>
	<author>Anonymous</author>
	<datestamp>1264346880000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>http://www.youtube.com/watch?v=I2d312\_dXEs</p></htmltext>
<tokenext>http : //www.youtube.com/watch ? v = I2d312 \ _dXEs</tokentext>
<sentencetext>http://www.youtube.com/watch?v=I2d312\_dXEs</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30883414</id>
	<title>Paypal payments for in game purchase?</title>
	<author>Anonymous</author>
	<datestamp>1264335720000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext>You might want to <a href="http://twitter.com/matshenricson/status/8121622033" title="twitter.com" rel="nofollow">reconsider that</a> [twitter.com].  That would be a definite show stopper for me, were I looking for an FB framework.  Until Paypal is regulated as the bank they are instead of allowing them to play bank, I won't be using them.  Seems to me this would be a negative selling point for the source as well.</htmltext>
<tokenext>You might want to reconsider that [ twitter.com ] .
That would be a definite show stopper for me , were I looking for an FB framework .
Until Paypal is regulated as the bank they are instead of allowing them to play bank , I wo n't be using them .
Seems to me this would be a negative selling point for the source as well .</tokentext>
<sentencetext>You might want to reconsider that [twitter.com].
That would be a definite show stopper for me, were I looking for an FB framework.
Until Paypal is regulated as the bank they are instead of allowing them to play bank, I won't be using them.
Seems to me this would be a negative selling point for the source as well.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875032</id>
	<title>Umm</title>
	<author>DrugCheese</author>
	<datestamp>1264262400000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>So why is he using State property for personal gain? My guess is his logs for his website were way too boring.</p><p>Shouldn't there be some agency in Florida who does not want their logs posted, even in cartoon format, in an internet video. I'm guessing this is probably either the Florida Dept. of Revenue or the Florida Dept. of Financial Services.</p></htmltext>
<tokenext>So why is he using State property for personal gain ?
My guess is his logs for his website were way too boring.Should n't there be some agency in Florida who does not want their logs posted , even in cartoon format , in an internet video .
I 'm guessing this is probably either the Florida Dept .
of Revenue or the Florida Dept .
of Financial Services .</tokentext>
<sentencetext>So why is he using State property for personal gain?
My guess is his logs for his website were way too boring.Shouldn't there be some agency in Florida who does not want their logs posted, even in cartoon format, in an internet video.
I'm guessing this is probably either the Florida Dept.
of Revenue or the Florida Dept.
of Financial Services.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850</id>
	<title>Why am I worried?</title>
	<author>Anonymous</author>
	<datestamp>1264260840000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>4</modscore>
	<htmltext>So you have access to these firewalls but you don't know how to go about diagnosing the problem aside from an Ask Slashdot? Am I the only one who's a little baffled by this?</htmltext>
<tokenext>So you have access to these firewalls but you do n't know how to go about diagnosing the problem aside from an Ask Slashdot ?
Am I the only one who 's a little baffled by this ?</tokentext>
<sentencetext>So you have access to these firewalls but you don't know how to go about diagnosing the problem aside from an Ask Slashdot?
Am I the only one who's a little baffled by this?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875394</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>Anonymous</author>
	<datestamp>1264265640000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Hi, Vince here for Slap Chop...</htmltext>
<tokenext>Hi , Vince here for Slap Chop.. .</tokentext>
<sentencetext>Hi, Vince here for Slap Chop...</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874904</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875056</id>
	<title>bot net</title>
	<author>Jessta</author>
	<datestamp>1264262580000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>My guess is that it's a bot net becoming active.<br>The countries with higher traffic during that period are countries that are widely known to have high bot net activity they are also more likely to have server bot net activity, which is why they don't stripe like the over countries.</p><p>The stripes are likely day/night where infected PCs are turned off when not in use.</p></htmltext>
<tokenext>My guess is that it 's a bot net becoming active.The countries with higher traffic during that period are countries that are widely known to have high bot net activity they are also more likely to have server bot net activity , which is why they do n't stripe like the over countries.The stripes are likely day/night where infected PCs are turned off when not in use .</tokentext>
<sentencetext>My guess is that it's a bot net becoming active.The countries with higher traffic during that period are countries that are widely known to have high bot net activity they are also more likely to have server bot net activity, which is why they don't stripe like the over countries.The stripes are likely day/night where infected PCs are turned off when not in use.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875998</id>
	<title>Stripes in the firewall log data? Movie Review</title>
	<author>Anonymous</author>
	<datestamp>1264271220000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>What are these stripes in the firewall log data? Movie Review<br>by the Anonymous Coward</p><p>Stripes in the firewall is a 4 and a half minute movie about a 3 dimensional representation of log data from an unspecified government website.<br>The cast consists only of the narrator, arkowitz, who walks the audience through the highlights of the dataset.<br>The storyline is rather weak to start off and develops into an international conspiracy and a web of intrigue that ultimately leads to Russia and Romania, represented by a vicious looking jagged blue stripe.<br>The feature is let down by the rather bland and uninspired performance of the narrator. I thought the wooden door in Paranormal Activity managed a more convincing performance.<br>This being a budget production, the 3D effects are not on par with some of the other recent releases. After watching Avatar in 3D, this movie will seem a little flat with or without the 3D glasses.<br>Overall, I found this feature slightly less engaging than the preposterous 2012.<br>This movie skipped the theaters, DVD release (not to mention the torrents) for a youtube release.</p><p>Better that: Ruslan<br>Worse than: Avatar 3D</p><p>Overall ***** 5/10</p></htmltext>
<tokenext>What are these stripes in the firewall log data ?
Movie Reviewby the Anonymous CowardStripes in the firewall is a 4 and a half minute movie about a 3 dimensional representation of log data from an unspecified government website.The cast consists only of the narrator , arkowitz , who walks the audience through the highlights of the dataset.The storyline is rather weak to start off and develops into an international conspiracy and a web of intrigue that ultimately leads to Russia and Romania , represented by a vicious looking jagged blue stripe.The feature is let down by the rather bland and uninspired performance of the narrator .
I thought the wooden door in Paranormal Activity managed a more convincing performance.This being a budget production , the 3D effects are not on par with some of the other recent releases .
After watching Avatar in 3D , this movie will seem a little flat with or without the 3D glasses.Overall , I found this feature slightly less engaging than the preposterous 2012.This movie skipped the theaters , DVD release ( not to mention the torrents ) for a youtube release.Better that : RuslanWorse than : Avatar 3DOverall * * * * * 5/10</tokentext>
<sentencetext>What are these stripes in the firewall log data?
Movie Reviewby the Anonymous CowardStripes in the firewall is a 4 and a half minute movie about a 3 dimensional representation of log data from an unspecified government website.The cast consists only of the narrator, arkowitz, who walks the audience through the highlights of the dataset.The storyline is rather weak to start off and develops into an international conspiracy and a web of intrigue that ultimately leads to Russia and Romania, represented by a vicious looking jagged blue stripe.The feature is let down by the rather bland and uninspired performance of the narrator.
I thought the wooden door in Paranormal Activity managed a more convincing performance.This being a budget production, the 3D effects are not on par with some of the other recent releases.
After watching Avatar in 3D, this movie will seem a little flat with or without the 3D glasses.Overall, I found this feature slightly less engaging than the preposterous 2012.This movie skipped the theaters, DVD release (not to mention the torrents) for a youtube release.Better that: RuslanWorse than: Avatar 3DOverall ***** 5/10</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30880438</id>
	<title>Delete this spam article please</title>
	<author>xerxesnine</author>
	<datestamp>1264361700000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>By keeping this article up you are rewarding spammers and inviting more of it.

When I receive spam, I mark and delete it. Don't you, Slashdot?</htmltext>
<tokenext>By keeping this article up you are rewarding spammers and inviting more of it .
When I receive spam , I mark and delete it .
Do n't you , Slashdot ?</tokentext>
<sentencetext>By keeping this article up you are rewarding spammers and inviting more of it.
When I receive spam, I mark and delete it.
Don't you, Slashdot?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874940</id>
	<title>Ad</title>
	<author>Anonymous</author>
	<datestamp>1264261500000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>5</modscore>
	<htmltext><p>it means that this is an ad for Quova and Green Phosphor's Glasshouse</p></htmltext>
<tokenext>it means that this is an ad for Quova and Green Phosphor 's Glasshouse</tokentext>
<sentencetext>it means that this is an ad for Quova and Green Phosphor's Glasshouse</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30886698</id>
	<title>Re:vertical stripes</title>
	<author>hearth00</author>
	<datestamp>1264361700000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Heck it could be packet responses from someone inside the network running a global port scan of some kind - this would account for the traffic at the same time from all countries, and the boosted responses from China etc. He never said anything about outgoing traffic, so his graph showing only half ths story can't determine anything...</htmltext>
<tokenext>Heck it could be packet responses from someone inside the network running a global port scan of some kind - this would account for the traffic at the same time from all countries , and the boosted responses from China etc .
He never said anything about outgoing traffic , so his graph showing only half ths story ca n't determine anything.. .</tokentext>
<sentencetext>Heck it could be packet responses from someone inside the network running a global port scan of some kind - this would account for the traffic at the same time from all countries, and the boosted responses from China etc.
He never said anything about outgoing traffic, so his graph showing only half ths story can't determine anything...</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875984</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>Anonymous</author>
	<datestamp>1264271040000</datestamp>
	<modclass>Interestin</modclass>
	<modscore>4</modscore>
	<htmltext><p><div class="quote"><p>Everyone always wants me to have labels on the graphs. I don't put them there unless you roll over the data, because I want you to see the patterns in the data without bias first.</p> </div><p>Why? The only reason for that would be so you could go, "Whoaahh, it's crazy looking." You've proven that. Anonymous data with no points of reference has no meaning. If you honestly think your graph has more value to the viewer than this <a href="http://www.math.yorku.ca/SCS/Gallery/images/stereo2.jpg" title="yorku.ca">graph from 1880</a> [yorku.ca] showing the population of Sweden over time, I think you're kidding yourself.</p><p><div class="quote"><p>It is actually pretty simple and makes it quite clear what is going on</p></div><p>That's debatable. I've argued that it could be much, <i>much</i> clearer.</p><p><div class="quote"><p>Finally, I am not interested in producing graphs which show you everything "at a glance". Use a pie chart for that. I am making graphs which facilitate a deeper understanding of larger amounts of data than Tufte dreamed of showing using his 2D paradigms.</p></div><p>Careful. If you're trying to get into the data visualization business, it's a bad idea to make it known that you're completely ignorant of Edward Tufte.</p><p>For starters, anyone who knows the slightest thing about Edward Tufte knows that he hates pie charts. So he would never say "use a pie chart for that."</p><p>Second, contrary to your assertion, Tufte advocates for extremely data-rich graphics wherever possible. He does not advocate abridging large data sets out of laziness. He does, however, advocate data compression when it will reveal data, and he does not like "wasted ink." Your graphs appear to have miles and miles and miles of plotted data -- none of which is identifiable without mouse interaction -- but relatively few points of interest. As you scroll through the data set, half your movie seems to feature the text "empty" hovering in midair above the graph. In other words, your dataset may indeed be large, but your visualization of it is not particularly informationally dense.</p><p>Finally, until such a time as your product can reach out of my flat-screen monitor and tweak me in the nose, you're every bit as tied to a "2D paradigm" as Tufte is. All you're doing is making it possible to adjust what is plotted in real time. Tufte would probably argue that it's better to get the plot right the first time. Allowing viewers to take their time to absorb a lot of data points is fine, but they shouldn't have to waste their time fiddling around with the plot to reveal those data points.</p></div>
	</htmltext>
<tokenext>Everyone always wants me to have labels on the graphs .
I do n't put them there unless you roll over the data , because I want you to see the patterns in the data without bias first .
Why ? The only reason for that would be so you could go , " Whoaahh , it 's crazy looking .
" You 've proven that .
Anonymous data with no points of reference has no meaning .
If you honestly think your graph has more value to the viewer than this graph from 1880 [ yorku.ca ] showing the population of Sweden over time , I think you 're kidding yourself.It is actually pretty simple and makes it quite clear what is going onThat 's debatable .
I 've argued that it could be much , much clearer.Finally , I am not interested in producing graphs which show you everything " at a glance " .
Use a pie chart for that .
I am making graphs which facilitate a deeper understanding of larger amounts of data than Tufte dreamed of showing using his 2D paradigms.Careful .
If you 're trying to get into the data visualization business , it 's a bad idea to make it known that you 're completely ignorant of Edward Tufte.For starters , anyone who knows the slightest thing about Edward Tufte knows that he hates pie charts .
So he would never say " use a pie chart for that .
" Second , contrary to your assertion , Tufte advocates for extremely data-rich graphics wherever possible .
He does not advocate abridging large data sets out of laziness .
He does , however , advocate data compression when it will reveal data , and he does not like " wasted ink .
" Your graphs appear to have miles and miles and miles of plotted data -- none of which is identifiable without mouse interaction -- but relatively few points of interest .
As you scroll through the data set , half your movie seems to feature the text " empty " hovering in midair above the graph .
In other words , your dataset may indeed be large , but your visualization of it is not particularly informationally dense.Finally , until such a time as your product can reach out of my flat-screen monitor and tweak me in the nose , you 're every bit as tied to a " 2D paradigm " as Tufte is .
All you 're doing is making it possible to adjust what is plotted in real time .
Tufte would probably argue that it 's better to get the plot right the first time .
Allowing viewers to take their time to absorb a lot of data points is fine , but they should n't have to waste their time fiddling around with the plot to reveal those data points .</tokentext>
<sentencetext>Everyone always wants me to have labels on the graphs.
I don't put them there unless you roll over the data, because I want you to see the patterns in the data without bias first.
Why? The only reason for that would be so you could go, "Whoaahh, it's crazy looking.
" You've proven that.
Anonymous data with no points of reference has no meaning.
If you honestly think your graph has more value to the viewer than this graph from 1880 [yorku.ca] showing the population of Sweden over time, I think you're kidding yourself.It is actually pretty simple and makes it quite clear what is going onThat's debatable.
I've argued that it could be much, much clearer.Finally, I am not interested in producing graphs which show you everything "at a glance".
Use a pie chart for that.
I am making graphs which facilitate a deeper understanding of larger amounts of data than Tufte dreamed of showing using his 2D paradigms.Careful.
If you're trying to get into the data visualization business, it's a bad idea to make it known that you're completely ignorant of Edward Tufte.For starters, anyone who knows the slightest thing about Edward Tufte knows that he hates pie charts.
So he would never say "use a pie chart for that.
"Second, contrary to your assertion, Tufte advocates for extremely data-rich graphics wherever possible.
He does not advocate abridging large data sets out of laziness.
He does, however, advocate data compression when it will reveal data, and he does not like "wasted ink.
" Your graphs appear to have miles and miles and miles of plotted data -- none of which is identifiable without mouse interaction -- but relatively few points of interest.
As you scroll through the data set, half your movie seems to feature the text "empty" hovering in midair above the graph.
In other words, your dataset may indeed be large, but your visualization of it is not particularly informationally dense.Finally, until such a time as your product can reach out of my flat-screen monitor and tweak me in the nose, you're every bit as tied to a "2D paradigm" as Tufte is.
All you're doing is making it possible to adjust what is plotted in real time.
Tufte would probably argue that it's better to get the plot right the first time.
Allowing viewers to take their time to absorb a lot of data points is fine, but they shouldn't have to waste their time fiddling around with the plot to reveal those data points.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879444</id>
	<title>video professor</title>
	<author>jdc18</author>
	<datestamp>1264356600000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Are you linked to the video professor</htmltext>
<tokenext>Are you linked to the video professor</tokentext>
<sentencetext>Are you linked to the video professor</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876272</id>
	<title>m$win phoning back home</title>
	<author>Anonymous</author>
	<datestamp>1264274760000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>just as simple as that,</p></htmltext>
<tokenext>just as simple as that,</tokentext>
<sentencetext>just as simple as that,</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879704</id>
	<title>Not enough information... or maybe too much...</title>
	<author>argent</author>
	<datestamp>1264358280000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>First, as many people have noted, these stripes could easily be due to events that have world-wide interest, and the spikes due to regional events. Without knowing the site involved there's not much point in speculating.</p><p>Second, if I was the admin at the unnamed site I'd be pissed that he'd disclosed firewall trace information to a data-mining company.</p><p>Third, not disclosing his relationship to the graphing company is pretty dodgy.</p></htmltext>
<tokenext>First , as many people have noted , these stripes could easily be due to events that have world-wide interest , and the spikes due to regional events .
Without knowing the site involved there 's not much point in speculating.Second , if I was the admin at the unnamed site I 'd be pissed that he 'd disclosed firewall trace information to a data-mining company.Third , not disclosing his relationship to the graphing company is pretty dodgy .</tokentext>
<sentencetext>First, as many people have noted, these stripes could easily be due to events that have world-wide interest, and the spikes due to regional events.
Without knowing the site involved there's not much point in speculating.Second, if I was the admin at the unnamed site I'd be pissed that he'd disclosed firewall trace information to a data-mining company.Third, not disclosing his relationship to the graphing company is pretty dodgy.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877370</id>
	<title>Re:Great ways to start a conversation</title>
	<author>PCM2</author>
	<datestamp>1264336800000</datestamp>
	<modclass>Troll</modclass>
	<modscore>0</modscore>
	<htmltext><p>Awww, man. I shoulda just wrote this one, saved myself some time.</p></htmltext>
<tokenext>Awww , man .
I shoulda just wrote this one , saved myself some time .</tokentext>
<sentencetext>Awww, man.
I shoulda just wrote this one, saved myself some time.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875140</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874838</id>
	<title>Botnets are fun</title>
	<author>Anonymous</author>
	<datestamp>1264260780000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Botnet timed actvation trying to hack into the Govt database that the firewall was protecting.</p></htmltext>
<tokenext>Botnet timed actvation trying to hack into the Govt database that the firewall was protecting .</tokentext>
<sentencetext>Botnet timed actvation trying to hack into the Govt database that the firewall was protecting.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874812</id>
	<title>2001</title>
	<author>jamesh</author>
	<datestamp>1264260600000</datestamp>
	<modclass>Funny</modclass>
	<modscore>1</modscore>
	<htmltext><p>Anyone else tempted to hum the theme tune to 2001 when they looked at that?</p><p>And also... "oh my god... it's full of stars"</p></htmltext>
<tokenext>Anyone else tempted to hum the theme tune to 2001 when they looked at that ? And also... " oh my god... it 's full of stars "</tokentext>
<sentencetext>Anyone else tempted to hum the theme tune to 2001 when they looked at that?And also... "oh my god... it's full of stars"</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892</id>
	<title>Re:vertical stripes</title>
	<author>jmauro</author>
	<datestamp>1264261080000</datestamp>
	<modclass>Informativ</modclass>
	<modscore>4</modscore>
	<htmltext><p>It looks like an active attack probably from one source with a number of controlled bots helping out.</p><p>The packets from every country at once are probably spoofs sender IP addresses from one or more sources (probably the spike countries).</p><p>The spiked country traffic are probably the controlled bots attacking the host actively.</p><p>Without seeing the actual packet data it's just a guess though.</p></htmltext>
<tokenext>It looks like an active attack probably from one source with a number of controlled bots helping out.The packets from every country at once are probably spoofs sender IP addresses from one or more sources ( probably the spike countries ) .The spiked country traffic are probably the controlled bots attacking the host actively.Without seeing the actual packet data it 's just a guess though .</tokentext>
<sentencetext>It looks like an active attack probably from one source with a number of controlled bots helping out.The packets from every country at once are probably spoofs sender IP addresses from one or more sources (probably the spike countries).The spiked country traffic are probably the controlled bots attacking the host actively.Without seeing the actual packet data it's just a guess though.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874848</id>
	<title>Filter your data...</title>
	<author>Itninja</author>
	<datestamp>1264260840000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>3</modscore>
	<htmltext>Is this guy filtering out backscatter like DNS replication and time updates? If it's from a State agency it's entirely possible that are running a root DNS server on-site (I work st a State agency and we are). Also, what timezone is he in? Knowing that might help explain the spike at 21:00. Is that GMT? Need input!</htmltext>
<tokenext>Is this guy filtering out backscatter like DNS replication and time updates ?
If it 's from a State agency it 's entirely possible that are running a root DNS server on-site ( I work st a State agency and we are ) .
Also , what timezone is he in ?
Knowing that might help explain the spike at 21 : 00 .
Is that GMT ?
Need input !</tokentext>
<sentencetext>Is this guy filtering out backscatter like DNS replication and time updates?
If it's from a State agency it's entirely possible that are running a root DNS server on-site (I work st a State agency and we are).
Also, what timezone is he in?
Knowing that might help explain the spike at 21:00.
Is that GMT?
Need input!</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875104</id>
	<title>If you don't know what your logs are...</title>
	<author>Anonymous</author>
	<datestamp>1264262820000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Then maybe you have been promoted to the point of failure. Typical government hiring... look for the degree first and the intelligence to pound sand out of a boot second.</p></htmltext>
<tokenext>Then maybe you have been promoted to the point of failure .
Typical government hiring... look for the degree first and the intelligence to pound sand out of a boot second .</tokentext>
<sentencetext>Then maybe you have been promoted to the point of failure.
Typical government hiring... look for the degree first and the intelligence to pound sand out of a boot second.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878220</id>
	<title>It seems to me...</title>
	<author>jellomizer</author>
	<datestamp>1264348380000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Do these stripes have to do anything with your business hours....</p><p>Starting work say a 9:00 everyone logs in checks and sends their email out getting server responces will create a stripe.  If other countries work with the organization they probably have their schedules match to the US time zones. (AKA working nights) So you get you start of the day stripe.  After cofee break stripe, lunch stripe, etc...</p><p>The stripes are not really a big deal.  I would pay more attention to the active countries</p></htmltext>
<tokenext>Do these stripes have to do anything with your business hours....Starting work say a 9 : 00 everyone logs in checks and sends their email out getting server responces will create a stripe .
If other countries work with the organization they probably have their schedules match to the US time zones .
( AKA working nights ) So you get you start of the day stripe .
After cofee break stripe , lunch stripe , etc...The stripes are not really a big deal .
I would pay more attention to the active countries</tokentext>
<sentencetext>Do these stripes have to do anything with your business hours....Starting work say a 9:00 everyone logs in checks and sends their email out getting server responces will create a stripe.
If other countries work with the organization they probably have their schedules match to the US time zones.
(AKA working nights) So you get you start of the day stripe.
After cofee break stripe, lunch stripe, etc...The stripes are not really a big deal.
I would pay more attention to the active countries</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874822</id>
	<title>No forreals...</title>
	<author>ihatewinXP</author>
	<datestamp>1264260720000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>RTFV: this is one of the more interesting problems ive seen posted in years.... Especially as a China resident... Odd... Thought<nobr> <wbr></nobr>/. community?</p><p>"Does this mean anything?"</p></htmltext>
<tokenext>RTFV : this is one of the more interesting problems ive seen posted in years.... Especially as a China resident... Odd... Thought / .
community ? " Does this mean anything ?
"</tokentext>
<sentencetext>RTFV: this is one of the more interesting problems ive seen posted in years.... Especially as a China resident... Odd... Thought /.
community?"Does this mean anything?
"</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877416</id>
	<title>Re:Looks like a sneaky ad to me.</title>
	<author>Jane Q. Public</author>
	<datestamp>1264337340000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Please do not misunderstand me: I am not suggesting that this particular user should be blocked. I meant it in a more general manner: if a user is attempting to spam Slashdot, can they be blocked? I think probably. After all Slashdot has been around a while. I bet they have run into more blatant attempts before. You have to at least give this guy credit for being somewhat clever about it.</htmltext>
<tokenext>Please do not misunderstand me : I am not suggesting that this particular user should be blocked .
I meant it in a more general manner : if a user is attempting to spam Slashdot , can they be blocked ?
I think probably .
After all Slashdot has been around a while .
I bet they have run into more blatant attempts before .
You have to at least give this guy credit for being somewhat clever about it .</tokentext>
<sentencetext>Please do not misunderstand me: I am not suggesting that this particular user should be blocked.
I meant it in a more general manner: if a user is attempting to spam Slashdot, can they be blocked?
I think probably.
After all Slashdot has been around a while.
I bet they have run into more blatant attempts before.
You have to at least give this guy credit for being somewhat clever about it.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30881442</id>
	<title>Visual analysis</title>
	<author>HooliganIntellectual</author>
	<datestamp>1264323600000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Somewhere, Edward Tufte is rolling over in his bed.</htmltext>
<tokenext>Somewhere , Edward Tufte is rolling over in his bed .</tokentext>
<sentencetext>Somewhere, Edward Tufte is rolling over in his bed.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876320</id>
	<title>Re:hey, i have access to this amazing tech</title>
	<author>benjamindees</author>
	<datestamp>1264275360000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>no, i'm not a salesman</p></div><p>Are you Fox Mulder?</p></div>
	</htmltext>
<tokenext>no , i 'm not a salesmanAre you Fox Mulder ?</tokentext>
<sentencetext>no, i'm not a salesmanAre you Fox Mulder?
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875386</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>NoTheory</author>
	<datestamp>1264263060000</datestamp>
	<modclass>Informativ</modclass>
	<modscore>5</modscore>
	<htmltext>If you check the other <a href="http://www.youtube.com/user/arkowitz" title="youtube.com">uploaded videos on youtube</a> [youtube.com] by the same guy (who's name appears to be "Ben Lindquist", the CEO of Green Phosphor, found on <a href="http://www.blogger.com/profile/13012834380543266190" title="blogger.com">blogger</a> [blogger.com] and <a href="http://twitter.com/arkowitz" title="twitter.com">twitter</a> [twitter.com]), there is an <a href="http://www.youtube.com/watch?v=s3H6m0GFP9M" title="youtube.com">introduction to Green Phosphor's Glasshouse</a> [youtube.com].  So yeah, Slashvertisement done in the style of Lost.<br>
<br>
Welcome to the future of advertising.<nobr> <wbr></nobr>/sigh.</htmltext>
<tokenext>If you check the other uploaded videos on youtube [ youtube.com ] by the same guy ( who 's name appears to be " Ben Lindquist " , the CEO of Green Phosphor , found on blogger [ blogger.com ] and twitter [ twitter.com ] ) , there is an introduction to Green Phosphor 's Glasshouse [ youtube.com ] .
So yeah , Slashvertisement done in the style of Lost .
Welcome to the future of advertising .
/sigh .</tokentext>
<sentencetext>If you check the other uploaded videos on youtube [youtube.com] by the same guy (who's name appears to be "Ben Lindquist", the CEO of Green Phosphor, found on blogger [blogger.com] and twitter [twitter.com]), there is an introduction to Green Phosphor's Glasshouse [youtube.com].
So yeah, Slashvertisement done in the style of Lost.
Welcome to the future of advertising.
/sigh.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875080</id>
	<title>Are the numbers supposed to be multiplied by 40?</title>
	<author>hellop2</author>
	<datestamp>1264262700000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>So 300p/hr = 12000p/hr?</htmltext>
<tokenext>So 300p/hr = 12000p/hr ?</tokentext>
<sentencetext>So 300p/hr = 12000p/hr?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30881682</id>
	<title>ask slashdot advertising = FAIL</title>
	<author>nufrosty</author>
	<datestamp>1264324860000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>advertising in the guise of an ask slashdot.. annoying.</htmltext>
<tokenext>advertising in the guise of an ask slashdot.. annoying .</tokentext>
<sentencetext>advertising in the guise of an ask slashdot.. annoying.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876594</id>
	<title>Not enough information</title>
	<author>ebrandsberg</author>
	<datestamp>1264365540000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>While this looks interesting, there isn't enough information to determine the cause.  What were the packets?</p><p>It could be DNS requests based on the expiration of a domain on the stripes.  The content on the website may be expiring at particular times.  Someone may be posting on blogs, or tweeting with a link to the page.</p><p>Simply put, without knowing what the content is, and filtering out "explainable" traffic, then looking at the result, any pattern is just an interesting curiosity, nothing more.</p></htmltext>
<tokenext>While this looks interesting , there is n't enough information to determine the cause .
What were the packets ? It could be DNS requests based on the expiration of a domain on the stripes .
The content on the website may be expiring at particular times .
Someone may be posting on blogs , or tweeting with a link to the page.Simply put , without knowing what the content is , and filtering out " explainable " traffic , then looking at the result , any pattern is just an interesting curiosity , nothing more .</tokentext>
<sentencetext>While this looks interesting, there isn't enough information to determine the cause.
What were the packets?It could be DNS requests based on the expiration of a domain on the stripes.
The content on the website may be expiring at particular times.
Someone may be posting on blogs, or tweeting with a link to the page.Simply put, without knowing what the content is, and filtering out "explainable" traffic, then looking at the result, any pattern is just an interesting curiosity, nothing more.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875194</id>
	<title>Re:Why am I worried?</title>
	<author>digitalchinky</author>
	<datestamp>1264263660000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>5</modscore>
	<htmltext><p>Why baffled? This is naught more than an advert for a graphic log analysis filter riding on the coattails of the google / China thing.</p><p>There are many others that go about the same task in different ways, most are free, this one is not.</p></htmltext>
<tokenext>Why baffled ?
This is naught more than an advert for a graphic log analysis filter riding on the coattails of the google / China thing.There are many others that go about the same task in different ways , most are free , this one is not .</tokentext>
<sentencetext>Why baffled?
This is naught more than an advert for a graphic log analysis filter riding on the coattails of the google / China thing.There are many others that go about the same task in different ways, most are free, this one is not.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874854</id>
	<title>Mystery?  What mystery?</title>
	<author>Anonymous</author>
	<datestamp>1264260900000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>1</modscore>
	<htmltext><p>Were you unaware that botnets spanned the globe, or that certain countries have a higher incidence of compromised systems?  If you don't understand those things, maybe you should get someone else to manage your firewalls?</p></htmltext>
<tokenext>Were you unaware that botnets spanned the globe , or that certain countries have a higher incidence of compromised systems ?
If you do n't understand those things , maybe you should get someone else to manage your firewalls ?</tokentext>
<sentencetext>Were you unaware that botnets spanned the globe, or that certain countries have a higher incidence of compromised systems?
If you don't understand those things, maybe you should get someone else to manage your firewalls?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876110</id>
	<title>Re:Privacy concerns - how did you get the data?</title>
	<author>osu-neko</author>
	<datestamp>1264272600000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>... Really I don't care what the site was, it just seems like there's no valid reason for anyone to have raw data rather than aggregated data outside that department.</p></div><p>Cool.  Write your senators and tell them that (a) you want them to raise your taxes, and (b) you want the extra money to be used to hire IT experts for every government office to analyze firewall traffic.</p><p>[If you aren't agreeable to (a), then don't bother whining about it.]</p></div>
	</htmltext>
<tokenext>... Really I do n't care what the site was , it just seems like there 's no valid reason for anyone to have raw data rather than aggregated data outside that department.Cool .
Write your senators and tell them that ( a ) you want them to raise your taxes , and ( b ) you want the extra money to be used to hire IT experts for every government office to analyze firewall traffic .
[ If you are n't agreeable to ( a ) , then do n't bother whining about it .
]</tokentext>
<sentencetext>... Really I don't care what the site was, it just seems like there's no valid reason for anyone to have raw data rather than aggregated data outside that department.Cool.
Write your senators and tell them that (a) you want them to raise your taxes, and (b) you want the extra money to be used to hire IT experts for every government office to analyze firewall traffic.
[If you aren't agreeable to (a), then don't bother whining about it.
]
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875264</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877920</id>
	<title>Re:Finally</title>
	<author>Anonymous</author>
	<datestamp>1264345740000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>What's a Poland?</p></htmltext>
<tokenext>What 's a Poland ?</tokentext>
<sentencetext>What's a Poland?</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874830</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875896</id>
	<title>Redundant firewalls?</title>
	<author>mooneypilot</author>
	<datestamp>1264270140000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext>Just a guess.
Stripes are caused by either a redundant firewall arrangement, or redundant feeds to the internet, where the load balancer (or telco) is moving traffic one way or the other..
Simple enough to reverse out your own IP..no need to outsource that part.
Lastly, you are working with a small sample size, (no more than a few hundreds of packets per line) so any small change appears larger.</htmltext>
<tokenext>Just a guess .
Stripes are caused by either a redundant firewall arrangement , or redundant feeds to the internet , where the load balancer ( or telco ) is moving traffic one way or the other. . Simple enough to reverse out your own IP..no need to outsource that part .
Lastly , you are working with a small sample size , ( no more than a few hundreds of packets per line ) so any small change appears larger .</tokentext>
<sentencetext>Just a guess.
Stripes are caused by either a redundant firewall arrangement, or redundant feeds to the internet, where the load balancer (or telco) is moving traffic one way or the other..
Simple enough to reverse out your own IP..no need to outsource that part.
Lastly, you are working with a small sample size, (no more than a few hundreds of packets per line) so any small change appears larger.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876134</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>Anonymous</author>
	<datestamp>1264272780000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>I wouldn't have had a problem with that if he had made that clear from the beginning. The idea is interesting, even if not really well executed. But trying to hide that info just makes me questions his ethics.</p></htmltext>
<tokenext>I would n't have had a problem with that if he had made that clear from the beginning .
The idea is interesting , even if not really well executed .
But trying to hide that info just makes me questions his ethics .</tokentext>
<sentencetext>I wouldn't have had a problem with that if he had made that clear from the beginning.
The idea is interesting, even if not really well executed.
But trying to hide that info just makes me questions his ethics.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874874</id>
	<title>Nice job, one question</title>
	<author>Anonymous</author>
	<datestamp>1264260960000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Great concept and presentation.  Point of clarification- you said you are counting inbound packets.  Did you differentiate between blocked/dropped &amp; passed traffic?</p></htmltext>
<tokenext>Great concept and presentation .
Point of clarification- you said you are counting inbound packets .
Did you differentiate between blocked/dropped &amp; passed traffic ?</tokentext>
<sentencetext>Great concept and presentation.
Point of clarification- you said you are counting inbound packets.
Did you differentiate between blocked/dropped &amp; passed traffic?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876800</id>
	<title>Re:Skylab Shreds</title>
	<author>The Archon V2.0</author>
	<datestamp>1264326120000</datestamp>
	<modclass>Funny</modclass>
	<modscore>2</modscore>
	<htmltext><p><div class="quote"><p>Not sure what it means, but I'm tempted to plug-in Guitar Hero and jam along to your firewall logs.</p></div><p>Just let me finish my Klax game first.</p></div>
	</htmltext>
<tokenext>Not sure what it means , but I 'm tempted to plug-in Guitar Hero and jam along to your firewall logs.Just let me finish my Klax game first .</tokentext>
<sentencetext>Not sure what it means, but I'm tempted to plug-in Guitar Hero and jam along to your firewall logs.Just let me finish my Klax game first.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875042</id>
	<title>It just means</title>
	<author>OeLeWaPpErKe</author>
	<datestamp>1264262460000</datestamp>
	<modclass>Interestin</modclass>
	<modscore>5</modscore>
	<htmltext><p>(this is a guess, obviously. Full netflow data would tell me more, but only way to be really sure would be a full packet trace)</p><p>This just shows that you're being scanned with random source IP adresses (that's why the vertical stripe lights up). It is essentially a check to see if part of the botnet has more firewall access than other parts, or if a loadbalancer directs stuff to different firewalls, or if you have additional BGP uplinks, some of which might not be quite as secure.</p><p>Then the real scan starts, which uses the information gained in the first phase to make sure it tests out all the firewalls the target network has. Especially in the case of backup bgp links, where traffic comes in on physically and administratively different lines (say 1 verizon, 1 at&amp;t, if you've got money to burn, and most govt. idiots feel the need to burn money). If the company in addition to the multiple uplinks outsources firewalls to those ISPs (or "security", not knowing what they're buying and getting nothing more than a smug false sense of security), again this is done by too many govt. agencies, you are bound to find holes this way. This uses actual bandwidth, and cannot be done on some networks. So what you're seeing is a disproportionate amount of scanning traffic coming from countries with fast networks and few watchful netadmins (or netadmins that just don't care, in Turkey's case), and many unsecured computers (and dear God, Turks and Russians really do not see any need for virusscanners, but generally you'd see a few other countries in there too. Heh the Russians are probably worried that running a virusscanner will interfere with their development of new viruses)</p><p>The regular repeats of vertical lines are probably to rescan reachability information, in case something changed. BGP can be twitchy, especially with incompetent local admins (on the botnet side of the network I mean)</p><p>From the (low) speed of the attack you can further deduce that it was an advanced attack, meant to stay below rate limiters, and presumably meant to stay below the radar. And from the resources required to pull this off you can deduce that this was not a lone hacker. Perhaps an organization (these days, tracing source ip's for security attacks almost invariably yields an IP address in far inland China, which is not because the russians have stopped attacking networks, but the Chinese are putting quantity above quality it seems these days).</p><p>And frankly, if someone has this kind of patience, generally they will find at least something, even in a well maintained network. Best hope it was only some files left out in the "public" folder or ~username folders. It's a good bet they probed the network security in other ways too (esp. googling), with IP's that will tell you much more about where the attack is coming from (using many hops is possible, but results in very slow page loads. And we're all human)</p><p>Btw : looking up a net's country can be done quickly via dns, no need for external company, no need for any tax dollars :</p><p>[kimmy@t61 ~]$ host -t TXT 104.79.125.74.cc.iploc.org<br>104.79.125.74.cc.iploc.org descriptive text "US"</p><p>(don't forget to reverse the IP address : looking up 1.2.3.4 is done by host -t TXT 4.3.2.1.cc.iploc.org)</p></htmltext>
<tokenext>( this is a guess , obviously .
Full netflow data would tell me more , but only way to be really sure would be a full packet trace ) This just shows that you 're being scanned with random source IP adresses ( that 's why the vertical stripe lights up ) .
It is essentially a check to see if part of the botnet has more firewall access than other parts , or if a loadbalancer directs stuff to different firewalls , or if you have additional BGP uplinks , some of which might not be quite as secure.Then the real scan starts , which uses the information gained in the first phase to make sure it tests out all the firewalls the target network has .
Especially in the case of backup bgp links , where traffic comes in on physically and administratively different lines ( say 1 verizon , 1 at&amp;t , if you 've got money to burn , and most govt .
idiots feel the need to burn money ) .
If the company in addition to the multiple uplinks outsources firewalls to those ISPs ( or " security " , not knowing what they 're buying and getting nothing more than a smug false sense of security ) , again this is done by too many govt .
agencies , you are bound to find holes this way .
This uses actual bandwidth , and can not be done on some networks .
So what you 're seeing is a disproportionate amount of scanning traffic coming from countries with fast networks and few watchful netadmins ( or netadmins that just do n't care , in Turkey 's case ) , and many unsecured computers ( and dear God , Turks and Russians really do not see any need for virusscanners , but generally you 'd see a few other countries in there too .
Heh the Russians are probably worried that running a virusscanner will interfere with their development of new viruses ) The regular repeats of vertical lines are probably to rescan reachability information , in case something changed .
BGP can be twitchy , especially with incompetent local admins ( on the botnet side of the network I mean ) From the ( low ) speed of the attack you can further deduce that it was an advanced attack , meant to stay below rate limiters , and presumably meant to stay below the radar .
And from the resources required to pull this off you can deduce that this was not a lone hacker .
Perhaps an organization ( these days , tracing source ip 's for security attacks almost invariably yields an IP address in far inland China , which is not because the russians have stopped attacking networks , but the Chinese are putting quantity above quality it seems these days ) .And frankly , if someone has this kind of patience , generally they will find at least something , even in a well maintained network .
Best hope it was only some files left out in the " public " folder or ~ username folders .
It 's a good bet they probed the network security in other ways too ( esp .
googling ) , with IP 's that will tell you much more about where the attack is coming from ( using many hops is possible , but results in very slow page loads .
And we 're all human ) Btw : looking up a net 's country can be done quickly via dns , no need for external company , no need for any tax dollars : [ kimmy @ t61 ~ ] $ host -t TXT 104.79.125.74.cc.iploc.org104.79.125.74.cc.iploc.org descriptive text " US " ( do n't forget to reverse the IP address : looking up 1.2.3.4 is done by host -t TXT 4.3.2.1.cc.iploc.org )</tokentext>
<sentencetext>(this is a guess, obviously.
Full netflow data would tell me more, but only way to be really sure would be a full packet trace)This just shows that you're being scanned with random source IP adresses (that's why the vertical stripe lights up).
It is essentially a check to see if part of the botnet has more firewall access than other parts, or if a loadbalancer directs stuff to different firewalls, or if you have additional BGP uplinks, some of which might not be quite as secure.Then the real scan starts, which uses the information gained in the first phase to make sure it tests out all the firewalls the target network has.
Especially in the case of backup bgp links, where traffic comes in on physically and administratively different lines (say 1 verizon, 1 at&amp;t, if you've got money to burn, and most govt.
idiots feel the need to burn money).
If the company in addition to the multiple uplinks outsources firewalls to those ISPs (or "security", not knowing what they're buying and getting nothing more than a smug false sense of security), again this is done by too many govt.
agencies, you are bound to find holes this way.
This uses actual bandwidth, and cannot be done on some networks.
So what you're seeing is a disproportionate amount of scanning traffic coming from countries with fast networks and few watchful netadmins (or netadmins that just don't care, in Turkey's case), and many unsecured computers (and dear God, Turks and Russians really do not see any need for virusscanners, but generally you'd see a few other countries in there too.
Heh the Russians are probably worried that running a virusscanner will interfere with their development of new viruses)The regular repeats of vertical lines are probably to rescan reachability information, in case something changed.
BGP can be twitchy, especially with incompetent local admins (on the botnet side of the network I mean)From the (low) speed of the attack you can further deduce that it was an advanced attack, meant to stay below rate limiters, and presumably meant to stay below the radar.
And from the resources required to pull this off you can deduce that this was not a lone hacker.
Perhaps an organization (these days, tracing source ip's for security attacks almost invariably yields an IP address in far inland China, which is not because the russians have stopped attacking networks, but the Chinese are putting quantity above quality it seems these days).And frankly, if someone has this kind of patience, generally they will find at least something, even in a well maintained network.
Best hope it was only some files left out in the "public" folder or ~username folders.
It's a good bet they probed the network security in other ways too (esp.
googling), with IP's that will tell you much more about where the attack is coming from (using many hops is possible, but results in very slow page loads.
And we're all human)Btw : looking up a net's country can be done quickly via dns, no need for external company, no need for any tax dollars :[kimmy@t61 ~]$ host -t TXT 104.79.125.74.cc.iploc.org104.79.125.74.cc.iploc.org descriptive text "US"(don't forget to reverse the IP address : looking up 1.2.3.4 is done by host -t TXT 4.3.2.1.cc.iploc.org)</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878270</id>
	<title>NetWitness</title>
	<author>Anonymous</author>
	<datestamp>1264348800000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Sounds like the state government should look at NetWitness.</p></htmltext>
<tokenext>Sounds like the state government should look at NetWitness .</tokentext>
<sentencetext>Sounds like the state government should look at NetWitness.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642</id>
	<title>Re:That wasn't complaining. THIS is complaining.</title>
	<author>Anonymous</author>
	<datestamp>1264268100000</datestamp>
	<modclass>Informativ</modclass>
	<modscore>1</modscore>
	<htmltext>Everyone always wants me to have labels on the graphs.  I don't put them there unless you roll over the data, because I want you to see the patterns in the data without bias first.
<br> <br>
I should not have called this graph "crazy looking".  It is actually pretty simple and makes it quite clear what is going on, as you can see from the comments submitted by people talking about botnets.
<br> <br>
Finally, I am not interested in producing graphs which show you everything "at a glance".  Use a pie chart for that.  I am making graphs which facilitate a deeper understanding of larger amounts of data than Tufte dreamed of showing using his 2D paradigms.</htmltext>
<tokenext>Everyone always wants me to have labels on the graphs .
I do n't put them there unless you roll over the data , because I want you to see the patterns in the data without bias first .
I should not have called this graph " crazy looking " .
It is actually pretty simple and makes it quite clear what is going on , as you can see from the comments submitted by people talking about botnets .
Finally , I am not interested in producing graphs which show you everything " at a glance " .
Use a pie chart for that .
I am making graphs which facilitate a deeper understanding of larger amounts of data than Tufte dreamed of showing using his 2D paradigms .</tokentext>
<sentencetext>Everyone always wants me to have labels on the graphs.
I don't put them there unless you roll over the data, because I want you to see the patterns in the data without bias first.
I should not have called this graph "crazy looking".
It is actually pretty simple and makes it quite clear what is going on, as you can see from the comments submitted by people talking about botnets.
Finally, I am not interested in producing graphs which show you everything "at a glance".
Use a pie chart for that.
I am making graphs which facilitate a deeper understanding of larger amounts of data than Tufte dreamed of showing using his 2D paradigms.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874898</id>
	<title>Temporal Discontinuity in Data</title>
	<author>wufpak</author>
	<datestamp>1264261140000</datestamp>
	<modclass>Insightful</modclass>
	<modscore>2</modscore>
	<htmltext><p>Looking at the pop-up labels that show up when you mouse-over the data, there seems to be a huge temporal discontinuity in your data set: right at the first vertical stripe, the displayed date/time labels jump from 2009-09-17 to 2009-09-27.  Maybe I'm just misreading the display, but a 10-day discontinuity would seem to account for the anomaly you describe.</p><p>It couldn't be that easy, could it?</p></htmltext>
<tokenext>Looking at the pop-up labels that show up when you mouse-over the data , there seems to be a huge temporal discontinuity in your data set : right at the first vertical stripe , the displayed date/time labels jump from 2009-09-17 to 2009-09-27 .
Maybe I 'm just misreading the display , but a 10-day discontinuity would seem to account for the anomaly you describe.It could n't be that easy , could it ?</tokentext>
<sentencetext>Looking at the pop-up labels that show up when you mouse-over the data, there seems to be a huge temporal discontinuity in your data set: right at the first vertical stripe, the displayed date/time labels jump from 2009-09-17 to 2009-09-27.
Maybe I'm just misreading the display, but a 10-day discontinuity would seem to account for the anomaly you describe.It couldn't be that easy, could it?</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876212</id>
	<title>He is the ceo [see his youtube comments]</title>
	<author>Anonymous</author>
	<datestamp>1264273800000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>This is a big advertisement.  The guy even admits he's the CEO in the youtube comments, but is combative about how that matters.  Yet he posts it here without disclosing that, very very shady.</p></htmltext>
<tokenext>This is a big advertisement .
The guy even admits he 's the CEO in the youtube comments , but is combative about how that matters .
Yet he posts it here without disclosing that , very very shady .</tokentext>
<sentencetext>This is a big advertisement.
The guy even admits he's the CEO in the youtube comments, but is combative about how that matters.
Yet he posts it here without disclosing that, very very shady.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875900</id>
	<title>The reason is quite obvious:</title>
	<author>Hurricane78</author>
	<datestamp>1264270200000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>and sent </p><p><div class="quote"><p>several million</p></div><p> of them to a company called Quova, who gave me back full location info on <strong>every 40th one</strong>.</p></div><p>Well, there you have it. Unless you can prove, that that filtering that Quova does, does not influence your results, you can&rsquo;t really draw any information from it. Could just be selectivity, applied by Quova. Or a otherwise bad filter.</p><p>Only if you are safe in that regard, would you first have to look at the actual outgoing traffic, in case there are correlations. (Which, considering the data, seems very likely.)</p></div>
	</htmltext>
<tokenext>and sent several million of them to a company called Quova , who gave me back full location info on every 40th one.Well , there you have it .
Unless you can prove , that that filtering that Quova does , does not influence your results , you can    t really draw any information from it .
Could just be selectivity , applied by Quova .
Or a otherwise bad filter.Only if you are safe in that regard , would you first have to look at the actual outgoing traffic , in case there are correlations .
( Which , considering the data , seems very likely .
)</tokentext>
<sentencetext>and sent several million of them to a company called Quova, who gave me back full location info on every 40th one.Well, there you have it.
Unless you can prove, that that filtering that Quova does, does not influence your results, you can’t really draw any information from it.
Could just be selectivity, applied by Quova.
Or a otherwise bad filter.Only if you are safe in that regard, would you first have to look at the actual outgoing traffic, in case there are correlations.
(Which, considering the data, seems very likely.
)
	</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875582</id>
	<title>Re:I see the people who have a clue haven't gotten</title>
	<author>Anonymous</author>
	<datestamp>1264267620000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>I see the people who have a clue still haven't gotten here yet</p></htmltext>
<tokenext>I see the people who have a clue still have n't gotten here yet</tokentext>
<sentencetext>I see the people who have a clue still haven't gotten here yet</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874866</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876326</id>
	<title>Re:Why am I worried?</title>
	<author>chiguy</author>
	<datestamp>1264275480000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>So you have access to these firewalls but you don't know how to go about diagnosing the problem aside from an Ask Slashdot? Am I the only one who's a little baffled by this?</p></div><p>I would ask, so you have access to government firewall information and you don't have an NDA?  That baffles me.</p></div>
	</htmltext>
<tokenext>So you have access to these firewalls but you do n't know how to go about diagnosing the problem aside from an Ask Slashdot ?
Am I the only one who 's a little baffled by this ? I would ask , so you have access to government firewall information and you do n't have an NDA ?
That baffles me .</tokentext>
<sentencetext>So you have access to these firewalls but you don't know how to go about diagnosing the problem aside from an Ask Slashdot?
Am I the only one who's a little baffled by this?I would ask, so you have access to government firewall information and you don't have an NDA?
That baffles me.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875076</id>
	<title>classic Bot activity</title>
	<author>Anonymous</author>
	<datestamp>1264262700000</datestamp>
	<modclass>None</modclass>
	<modscore>0</modscore>
	<htmltext><p>Considering the countries involved and the pattern of propagation it seems obviously bots. Remember also they took every 40th packet so when he says a 100 pings he's talking 4,000 which is a lot of activity.</p></htmltext>
<tokenext>Considering the countries involved and the pattern of propagation it seems obviously bots .
Remember also they took every 40th packet so when he says a 100 pings he 's talking 4,000 which is a lot of activity .</tokentext>
<sentencetext>Considering the countries involved and the pattern of propagation it seems obviously bots.
Remember also they took every 40th packet so when he says a 100 pings he's talking 4,000 which is a lot of activity.</sentencetext>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877700</id>
	<title>Re:Another Slashdot Ad?</title>
	<author>/.Rooster</author>
	<datestamp>1264342440000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p>Well simple way to show your disapproval is to rate the video a 1 or post a negative comment. Rating is easy but I can't be bothered to comment. No way I am getting that 4 minutes 36 seconds back now. Not worth the effort.</p></htmltext>
<tokenext>Well simple way to show your disapproval is to rate the video a 1 or post a negative comment .
Rating is easy but I ca n't be bothered to comment .
No way I am getting that 4 minutes 36 seconds back now .
Not worth the effort .</tokentext>
<sentencetext>Well simple way to show your disapproval is to rate the video a 1 or post a negative comment.
Rating is easy but I can't be bothered to comment.
No way I am getting that 4 minutes 36 seconds back now.
Not worth the effort.</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128</parent>
</comment>
<comment>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876312</id>
	<title>Re:It's the people avoiding patterns to fear.</title>
	<author>benjamindees</author>
	<datestamp>1264275300000</datestamp>
	<modclass>None</modclass>
	<modscore>1</modscore>
	<htmltext><p><div class="quote"><p>The countries he points out are all in the same timezones so it's probably just their normal day starting.</p></div><p>He says in the video that it's five days of data.</p></div>
	</htmltext>
<tokenext>The countries he points out are all in the same timezones so it 's probably just their normal day starting.He says in the video that it 's five days of data .</tokentext>
<sentencetext>The countries he points out are all in the same timezones so it's probably just their normal day starting.He says in the video that it's five days of data.
	</sentencetext>
	<parent>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875312</parent>
</comment>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_50</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875984
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878356
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_36</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876800
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_40</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876182
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877200
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_26</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876480
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_28</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876494
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_31</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874902
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_49</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876328
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_56</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875424
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_55</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879554
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_46</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875274
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876004
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_23</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877308
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_8</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875062
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_30</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874866
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875582
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_13</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875854
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30882956
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_47</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875524
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_20</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877700
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_4</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876326
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_54</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875042
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877450
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_39</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875826
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_44</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876620
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_5</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875264
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876110
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_18</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877416
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_21</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875562
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_12</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875900
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876352
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_35</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875274
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876166
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_11</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875226
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_1</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875312
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876312
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_41</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876188
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_34</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874848
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30899278
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_10</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877000
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_33</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875240
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_24</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875498
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_48</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875140
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875992
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_9</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875446
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_25</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875946
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_53</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877118
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_27</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875984
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876086
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_29</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875194
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_32</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876250
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_6</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875386
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876320
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_17</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874914
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877172
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_19</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874830
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877920
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_22</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875042
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875556
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_45</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877766
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_2</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876134
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_52</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877566
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_7</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878190
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_38</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877224
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_51</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875900
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877258
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_14</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875808
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_42</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875906
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_37</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874872
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874924
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_16</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875842
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_3</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874904
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875394
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_15</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30886698
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_43</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878178
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_0</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875140
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877370
</commentlist>
</thread>
<thread>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#thread_10_01_23_2327204_57</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874848
http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879530
</commentlist>
</thread>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.31</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875854
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30882956
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.18</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875392
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876620
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877416
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877766
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876250
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876188
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.5</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875900
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876352
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877258
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.29</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874914
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877172
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.3</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874820
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875946
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874892
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875424
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877000
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878178
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875842
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30886698
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875524
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875062
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874902
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.12</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874850
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875226
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875194
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876326
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.23</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874940
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.19</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874812
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.10</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874862
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.21</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874830
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877920
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.24</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874898
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.22</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876272
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.9</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874848
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879530
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30899278
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.4</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875312
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876312
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.27</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874766
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877118
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876800
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877566
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.16</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874846
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.7</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875346
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.25</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877432
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.2</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874816
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.14</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874872
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874924
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.11</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875264
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876110
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.1</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875176
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.17</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875386
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876320
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.28</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875274
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876004
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876166
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.26</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874866
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875582
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.20</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875032
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.8</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874840
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874904
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875394
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878190
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875128
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875446
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875562
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877700
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876134
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876494
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.15</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874944
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30879554
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875108
--http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875278
---http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875498
---http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877308
---http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876328
---http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875826
---http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875642
----http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877224
----http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876182
-----http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877200
----http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875984
-----http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30878356
-----http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876086
---http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875808
---http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30876480
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875240
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875906
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.6</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875080
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.32</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875140
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875992
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877370
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.13</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875042
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875556
-http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30877450
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.33</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874786
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.0</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30874822
</commentlist>
</conversation>
<conversation>
	<id>http://www.semanticweb.org/ontologies/ConversationInstances.owl#conversation10_01_23_2327204.30</id>
	<commentlist>http://www.semanticweb.org/ontologies/ConversationInstances.owl#comment10_01_23_2327204.30875114
</commentlist>
</conversation>
