Lessons Learned from Operating a Large Network Telescope

Research output: Contribution to book/Conference proceedings/Anthology/ReportConference contributionContributedpeer-review

Contributors

Abstract

Network telescopes (aka darknets) collect unsolicited Internet traffic (aka Internet background radiation or IBR), which includes benign and malicious scanning as well as artifacts of spoofed denial-of-service attacks and misconfigured software and hosts. Analysis of this traffic has revealed macroscopic insights into security-related events and global network dynamics such as outages. Operating a large-scale network telescope is challenging but often taken for granted, more so than in more mature scientific disciplines. We offer the first study documenting our experiences operating the UCSD Network Telescope, the largest and longest-operating network telescope supporting scientific research. We provide background on the history of the telescope, and focus on increasing operational challenges as the underlying network evolves. We develop and apply techniques to leverage third-party scanning activity to validate the integrity of the data, and to discover misconfigurations in the instrumentation. These insights are crucial for understanding measurement results, which we illustrate using concrete examples. We discuss how our findings generalize to support the expanding ecosystem of other passive techniques, such as honeypots, to track security phenomena.

Details

Original languageEnglish
Title of host publicationProceedings of ACM SIGCOMM
PublisherACM New York, NY, USA
Pages826-841
Number of pages16
ISBN (electronic)9798400715242
Publication statusPublished - Aug 2025
Peer-reviewedYes

Conference

Title39th annual conference of the ACM Special Interest Group on Data Communication
Abbreviated titleACM SIGCOMM 2025
Conference number39
Duration8 - 11 September 2025
Website
Degree of recognitionInternational event
LocationSão Francisco Convent
CityCoimbra
CountryPortugal

External IDs

ORCID /0000-0002-3825-2807/work/188859607
Scopus 105016161640

Keywords

DFG Classification of Subject Areas according to Review Boards

Subject groups, research areas, subject areas according to Destatis

Keywords

  • UCSD-NT, passive measurements, IPv4, darknet, research infrastructure, network telescope, operational experience