Internet background noise (IBN, also known as Internet background radiation) consists of data
packet
Packet may refer to:
* A small container or pouch
** Packet (container), a small single use container
** Cigarette packet
** Sugar packet
* Network packet, a formatted unit of data carried by a packet-mode computer network
* Packet radio, a form ...
s on the
Internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
which are addressed to
IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
es or
port
A port is a maritime facility comprising one or more wharves or loading areas, where ships load and discharge cargo and passengers. Although usually situated on a sea coast or estuary, ports can also be found far inland, such as Ham ...
s where there is no network device set up to receive them.
These packets often contain unsolicited commercial or
network control messages, or are the result of
port scan
A port scanner is an application designed to probe a server or host for open ports. Such an application may be used by administrators to verify security policies of their networks and by attackers to identify network services running on a host an ...
s and
worm
Worms are many different distantly related bilateral animals that typically have a long cylindrical tube-like body, no limbs, and no eyes (though not always).
Worms vary in size from microscopic to over in length for marine polychaete wor ...
activities.
Smaller devices such as
DSL modem
A digital subscriber line (DSL) modem is a device used to connect a computer or router to a telephone line which provides the digital subscriber line (DSL) service for connection to the Internet, which is often called ''DSL broadband''. The m ...
s may have a
hard-coded
Hard coding (also hard-coding or hardcoding) is the software development practice of embedding data directly into the source code of a program or other executable object, as opposed to obtaining the data from external sources or generating it at ...
IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
to look up the correct time using the
Network Time Protocol
The Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable- latency data networks. In operation since before 1985, NTP is one of the oldest Internet protocols in c ...
. If, for some reason, the hard-coded NTP server is no longer available, faulty software might retry failed requests up to every second, which, if many devices are affected, generates a
significant amount of unnecessary request traffic.
Historical context
In the first 10 years of the Internet, there was very little background noise but with its commercialization in the 1990s the noise factor became a permanent feature.
The
Conficker
Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008. It uses flaws in Windows OS software and dictionary attacks on administrator passw ...
worm in recent times was responsible for a large amount of background noise generated by viruses looking for new victims. In addition to malicious activities, misconfigured hardware and leaks from private networks are also sources of background noise.
2000s
As of November 2010, it is estimated that 5.5 gigabits (687.5 megabytes) of background noise are generated every second.
It was also estimated in the early 2000s that a dial-up modem user loses about 20 bits per second of their
bandwidth
Bandwidth commonly refers to:
* Bandwidth (signal processing) or ''analog bandwidth'', ''frequency bandwidth'', or ''radio bandwidth'', a measure of the width of a frequency range
* Bandwidth (computing), the rate of data transfer, bit rate or thr ...
to unsolicited traffic. Over the past decade, the amount of background noise for an IPv4 /8 address block (which contains 16.7 million address) has increased from 1 to 50
Mbit/s
In telecommunications, data-transfer rate is the average number of bits (bitrate), characters or symbols (baudrate), or data blocks per unit time passing through a communication link in a data-transmission system. Common data rate units are multi ...
(1
KB/s
In telecommunications, data-transfer rate is the average number of bits ( bitrate), characters or symbols ( baudrate), or data blocks per unit time passing through a communication link in a data-transmission system. Common data rate units are mu ...
to 6.25
MB/s
In telecommunications, data-transfer rate is the average number of bits (bitrate), characters or symbols (baudrate), or data blocks per unit time passing through a communication link in a data-transmission system. Common data rate units are multi ...
). The newer
IPv6
Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communication protocol, communications protocol that provides an identification and location system for computers on networks and routes traffic ...
protocol, which has a much larger address space, will make it more difficult for viruses to
scan ports and also limit the impact of misconfigured equipment.
Internet background noise has been used to detect significant changes in Internet traffic and connectivity during the
2011 political unrest from IP address blocks that were
geolocated to Libya.
Backscatter is a term coined by
Vern Paxson
Vern Edward Paxson is a Professor of Computer Science at the University of California, Berkeley. He also leads the Networking and Security Group at the International Computer Science Institute in Berkeley, California. His interests range from tr ...
to describe Internet background noise resulting from a
DDoS
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host
A ...
attack using multiple spoofed addresses.
[Moore et al]
Inferring Internet Denial-of-Service Activity
2001 This
backscatter
In physics, backscatter (or backscattering) is the reflection of waves, particles, or signals back to the direction from which they came. It is usually a diffuse reflection due to scattering, as opposed to specular reflection as from a mirror, a ...
noise is used by
network telescope A network telescope (also known as a packet telescope, darknet, Internet motion sensor or black hole) is an Internet system that allows one to observe different large-scale events taking place on the Internet. The basic idea is to observe traffic ta ...
s to indirectly observe large scale attacks in real time.
See also
*
Network telescope A network telescope (also known as a packet telescope, darknet, Internet motion sensor or black hole) is an Internet system that allows one to observe different large-scale events taking place on the Internet. The basic idea is to observe traffic ta ...
References
Noise (electronics)
{{Internet-stub