Right away, I see that there are services in homer that have been decommissioned.
I see:

• labstore1001/2/3 T187456 (replaced by cloudstore1008/9, which live in the public network)
• labsdb1004/5/6/7 T216749 T220144 (all now on VMs)

Besides that:

• dbproxy's for the wikireplicas are changing, which might just need a labeling change in comments T231520
• port restrictions for labstores may have changed as a result of https://gerrit.wikimedia.org/r/c/operations/puppet/+/571821, which makes the labstore1004/5 set more firmly nfsv4 than they were. We may be able to close some of those ports that are currently open.

Note that we only have netflow at our borders, and we sample 1:1000 so it might not be the right tool for now.

There are several options though:

• Add an iptables rule to log the packet, then exploit the data through Kibana, see for example https://logstash.wikimedia.org/app/kibana#/dashboard/AW5v7YTUarkxubcmAwPB
• Do the same as above but with a firewall filter on the routers, preferably for a short amount of time as they flood the devices logs