smb protocol stats for 2010 so far
gnuplotsql.py is a script I wrote to visualize the sqlite database in a useful way.
You can browse my statistics here while you use the script to create stats for your own database:
time ./gnuplotsql.py -d /opt/dionaea/var/dionaea/logsql.sqlite -p smbd -p epmapper -p mssqld -p httpd -p ftpd
Be aware, the script takes some time, in my case 25minutes for a 89MByte large database.
And, in fact, browsing the images you can identify things you may have missed before, for example this one:
There is a sudden rise in http connections, but the number of hosts accessing dioneaea's httpd does not really increase.
Looking at the traffic I saw this:
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (ABE, http://noscript.net/abe/wan)
which is issued by my desktop, turns out, thats the side effect of a new NoScript feature.