|  |  | To witness an intrusion in progress, you would have to actively monitor your log files or use a packet analyzer that tracks data as it passes through your network. Even if you were capable of monitoring all packets, many people question what an attack actually looks like. Few are aware of what a syn flood looks like. Most are not familiar with the data that normally exists on their networks. You may never know what data should not be on your network without first gathering a strong baseline of the appropriate data that may be on your network.