This paper considers anomaly network traffic detection using different network feature subsets. Fuzzy c-means vector quantization is used to train network attack models and the minimum distortion rule is applied to detect network attacks. We also demonstrate the effectiveness and ineffectiveness in finding anomalies by looking at the network data alone. Experiments performed on the KDD CUP 1999 dataset show that time based traffic features in the last two second time window should be selected to obtain highest detection rates.