Network data that contains both qualitative and quantitative traces of malicious activity is difficult to come by. Once found, it is typically guarded by non-disclosure agreements that limit its usefulness for widespread research and analysis. Fortunately, the annual Cyber Defense Exercise between the US military academies provides four days of valuable network data; capturing both reconnaissance and attack actions. We have taken data from the 2002 and 2003 exercises and conducted an analysis of the traffic to provide an insight into traffic patterns associated with malicious activity.