Motivation Why measure global DoS activity? Measure wasted bandwidth Observed trends Measure what? Duration Protocol distribution Counts: packets, bytes Target distribution