Lessons Learned from Operating a Large Network Telescope
Research output: Contribution to book/Conference proceedings/Anthology/Report › Conference contribution › Contributed › peer-review
Contributors
Abstract
Network telescopes (aka darknets) collect unsolicited Internet traffic (aka Internet background radiation or IBR), which includes benign and malicious scanning as well as artifacts of spoofed denial-of-service attacks and misconfigured software and hosts. Analysis of this traffic has revealed macroscopic insights into security-related events and global network dynamics such as outages. Operating a large-scale network telescope is challenging but often taken for granted, more so than in more mature scientific disciplines. We offer the first study documenting our experiences operating the UCSD Network Telescope, the largest and longest-operating network telescope supporting scientific research. We provide background on the history of the telescope, and focus on increasing operational challenges as the underlying network evolves. We develop and apply techniques to leverage third-party scanning activity to validate the integrity of the data, and to discover misconfigurations in the instrumentation. These insights are crucial for understanding measurement results, which we illustrate using concrete examples. We discuss how our findings generalize to support the expanding ecosystem of other passive techniques, such as honeypots, to track security phenomena.
Details
| Original language | English |
|---|---|
| Title of host publication | Proceedings of ACM SIGCOMM |
| Publisher | ACM New York, NY, USA |
| Pages | 826-841 |
| Number of pages | 16 |
| ISBN (electronic) | 9798400715242 |
| Publication status | Published - Aug 2025 |
| Peer-reviewed | Yes |
Conference
| Title | 39th annual conference of the ACM Special Interest Group on Data Communication |
|---|---|
| Abbreviated title | ACM SIGCOMM 2025 |
| Conference number | 39 |
| Duration | 8 - 11 September 2025 |
| Website | |
| Degree of recognition | International event |
| Location | São Francisco Convent |
| City | Coimbra |
| Country | Portugal |
External IDs
| ORCID | /0000-0002-3825-2807/work/188859607 |
|---|---|
| Scopus | 105016161640 |
Keywords
Research priority areas of TU Dresden
DFG Classification of Subject Areas according to Review Boards
Subject groups, research areas, subject areas according to Destatis
Sustainable Development Goals
ASJC Scopus subject areas
Keywords
- UCSD-NT, passive measurements, IPv4, darknet, research infrastructure, network telescope, operational experience