The following data sets are in SiLK format; SiLK-v0.10.0 or greater is required to read them. The data sets assume you have configured SiLK with sensors named S0 and S1.


This sample data is derived from anonymized enterprise header traces obtained from Lawrence Berkeley National Laboratory and ICSI, and is used here with their permission. This data covers selected hours on selected dates in late 2004 and early 2005. For more information on this dataset, see

The data is packaged in two files; one containing the non-scanning traffic and the other containing the scanning traffic. To unpack the file, run

gzip -d -c SiLK-LBNL-05-nonscan.tar.gz | tar xf -

Each file will unpack into the directory SiLK-LBNL-05, which can be used as the top-level data directory for rwfilter by setting the environment variable SILK_DATA_ROOTDIR to the directory's location. The non-scanning traffic appears as sensor S0, and the scanning traffic as sensor S1. This allows the two sets of data to be analyzed together (though note that the two sets of data are anonymized differently) or separately (via the --sensor switch).

The inside of the network is assumed to contain the following CIDR blocks:
Non-scanning traffic



Scanning traffic