1 files changed, 48 insertions, 0 deletions
diff --git a/2026/2026-05-17-gribouille/drop.typ b/2026/2026-05-17-gribouille/drop.typ
new file mode 100644
index 0000000..b830494
--- /dev/null
+++ b/2026/2026-05-17-gribouille/drop.typ
@@ -0,0 +1,48 @@
+#import "./gribouille/lib.typ":*
+
+#set text(font: "Goldman Sans")
+
+#let results = csv("src_ip_last1h.csv", row-type: dictionary)
+
+#let p = plot(
+    data: results,
+    mapping: aes(
+      x: "total_sessions",
+      y: "unique_dst_ports",
+      size: "unique_sensors",
+    ),
+    layers: (
+      geom-point(alpha: 0.65),
+      annotate(
+        "text",
+        x: 23424,
+        y: 3,
+        label: typst(align(right)[`93.123.72.166` dominates with\ ~77% of non-spoofable traffic.]),
+        anchor: "south-east",
+        dx: 0.0,
+        dy: 0.3,
+        size: 7pt,
+      ),
+    ),
+    scales: (
+      scale-x-log10(labels: format-comma()),
+      scale-y-log10(),
+      scale-size-area(),
+    ),
+    labs: labs(
+      title: typst([#h(1.5cm)Sensor Fleet Activity (1 Hour)]),
+      subtitle: typst(pad(left: 1.5cm)[943 source IPs across 30,460 sessions in the last hour.]),
+      x: "Total Sessions (log₁₀)",
+      y: "Unique Destination Ports",
+      size: "# Unique Sensors",
+    ),
+    theme: theme-minimal(
+      text: element-text(),
+      plot-title: element-text(size: 14pt, weight: "bold"),
+      plot-subtitle: element-text(margin: margin(left:3in)),
+    ),
+    width: 14cm,
+    height: 9cm,
+  )
+
+  #p