A network telescope (also known as a packet telescope,
darknet, Internet motion sensor or black hole)
is an
Internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
system that allows one to observe different large-scale events taking place on the Internet. The basic idea is to observe traffic targeting the
dark (unused) address-space of the network. Since all traffic to these addresses is suspicious, one can gain information about possible network attacks (random scanning worms, and
DDoS backscatter) as well as other misconfigurations by observing it.
The resolution of the Internet telescope is dependent on the number of
IP addresses
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
it monitors. For example, a large Internet telescope that monitors traffic to 16,777,216 addresses (the Internet telescope in
IPv4
Internet Protocol version 4 (IPv4) is the fourth version of the Internet Protocol (IP). It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks. IPv4 was the first version de ...
), has a higher probability of observing a relatively small event than a smaller telescope that monitors 65,536 addresses (a Internet telescope).
The naming comes from an analogy to
optical telescope
An optical telescope is a telescope that gathers and focuses light mainly from the visible part of the electromagnetic spectrum, to create a magnified image for direct visual inspection, to make a photograph, or to collect data through electro ...
s, where a larger physical size allows more
photon
A photon () is an elementary particle that is a quantum of the electromagnetic field, including electromagnetic radiation such as light and radio waves, and the force carrier for the electromagnetic force. Photons are massless, so they always ...
s to be observed.
A variant of a network telescope is a sparse darknet, or greynet, consisting of a region of
IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
space that is sparsely populated with "darknet" addresses interspersed with active (or "lit") IP addresses.
[ These include a greynet assembled from 210,000 unused IP addresses mainly located in Japan.]
Large network telescope instances
See also
*Honeypot (computing)
In computer terminology, a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of data (for example, in a network site ...
*Internet background noise Internet background noise (IBN, also known as Internet background radiation) consists of data packets on the Internet which are addressed to IP addresses or ports where there is no network device set up to receive them.
These packets often contain ...
References
Further reading
*
*
External links
CAIDA Network Telescope
at University of Californian, San Diego
at Team Cymru Darknet
Internet terminology
{{compu-network-stub