A tale of two CTs
George Corser · 2012
Two distinct curve tendencies (CTs) characterize the flow of IP packets rejected by a firewall from specific source IP addresses. One flow model appears relatively flat and steady over time. The other manifests as a single sharp spike. This study examines a recent real-world firewall log which exhibits these two patterns.