A network telescope (also known as a packet telescope,
darknet, Internet motion sensor or black hole)
is an
Internet
The Internet (or internet) is the Global network, global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a internetworking, network of networks ...
system that allows one to observe different large-scale events taking place on the Internet. The basic idea is to observe traffic targeting the dark (unused) address-space of the network. Since all traffic to these addresses is suspicious, one can gain information about possible network attacks (random scanning worms, and
DDoS backscatter) as well as other misconfigurations by observing it.
The resolution of the Internet telescope is dependent on the number of
IP address
An Internet Protocol address (IP address) is a numerical label such as that is assigned to a device connected to a computer network that uses the Internet Protocol for communication. IP addresses serve two main functions: network interface i ...
es it monitors. For example, a large Internet telescope that monitors traffic to 16,777,216 addresses (the Internet telescope in
IPv4
Internet Protocol version 4 (IPv4) is the first version of the Internet Protocol (IP) as a standalone specification. It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks. ...
), has a higher probability of observing a relatively small event than a smaller telescope that monitors 65,536 addresses (a Internet telescope).
The naming comes from an analogy to
optical telescope
An optical telescope gathers and focus (optics), focuses light mainly from the visible spectrum, visible part of the electromagnetic spectrum, to create a magnification, magnified image for direct visual inspection, to make a photograph, or to co ...
s, where a larger physical size allows more
photon
A photon () is an elementary particle that is a quantum of the electromagnetic field, including electromagnetic radiation such as light and radio waves, and the force carrier for the electromagnetic force. Photons are massless particles that can ...
s to be observed.
A variant of a network telescope is a sparse darknet, or greynet, consisting of a region of
IP address
An Internet Protocol address (IP address) is a numerical label such as that is assigned to a device connected to a computer network that uses the Internet Protocol for communication. IP addresses serve two main functions: network interface i ...
space that is sparsely populated with "darknet" addresses interspersed with active (or "lit") IP addresses.
[ These include a greynet assembled from 210,000 unused IP addresses mainly located in Japan.]
Large network telescope instances
See also
*Honeypot (computing)
In computer terminology, a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of data (for example, in a network site ...
* Internet background noise
References
Further reading
*
*
External links
CAIDA Network Telescope
at University of Californian, San Diego
at Team Cymru Darknet
Internet terminology
Long stubs with short prose
{{compu-network-stub