Technologies are generally described for methods and systems effective to generate an alert in a data center. In some examples, a device may detect an execution of a virtual machine in the data center. The device may also analyze traffic data at a port that may be in the data center. The traffic data may be associated with a communication from the virtual machine to a destination address through the port. The device may also compare the destination address with a data center address of the data center. The device may also generate the alert based on the comparison.