Internet traffic entering and leaving the Urbana campus is analyzed for indicators of cyberattack using the network security monitoring software zeek.

When an attack is detected, connectivity with the attacker is automatically blocked. The length of the block depends on the number of previous blocks for the same IP address.

Only metadata describing the traffic is captured and analyzed; the content of traffic is not captured or analyzed.

A copy of some Internet traffic entering campus may be forwarded to the Refraction Networking project.