The UCSD network telescope consists of a globally routed /8 network
that carries almost no legitimate traffic. Because the legitimate
traffic is easy to separate from the incoming packets, the network
telescope provides us with a monitoring point for anomalous traffic
that represents almost 1/256th of all IPv4 destination addresses
on the Internet.
Because a network telescope (also known as a blackhole, an Internet
sink, or a darknet) does not contain any real computers, there is no
reason that legitimate traffic would be monitored by the network
telescope. The network telescope collects traffic as a result of
wide range of events, including misconfiguration (e.g. a human being
mis-typing an IP address), malicious scanning of address space by
hackers looking for vulnerable targets, backscatter from random
source denial-of-service attacks, and the automated spread of
malicious software called Internet worms.
While researchers at CAIDA and in the network security community
are still working to identify the sources of the misconfigurations
and other human errors that send traffic into the network telescope,
the utility of network telescopes for identifying denial-of-service
attack victims and tracking the spread of Internet worms has been
more thoroughly explored.
Related work:
For more information on network telescopes, including information
on how the size of the address space monitored affects the trends
monitored, see
Network Telescope Technical Report.
For information on other network telescopes in operation, see:
For information on how to set up your own network telescope, see:
Denial-of-service Attacks
The UCSD network telescope can be used to monitor the spread of
random-source distributed denial-of-service attacks. When an
attacker wants to make it difficult for the attack victim (and
the victim's ISP(s)) to block an incoming attack, the attacker
uses a fake source IP address (similar to a fake return address
in postal mail) in each packet sent to the victim (Figure 1).
Because the attack victim can't distinguish between incoming
requests from an attacker and legitimate inbound requests, the
denial-of-service attack victim tries to respond to every
request it receives (Figure 2). When the attacker spoofs a
source address in the network telescope, we monitor a response
destined for a computer that doesn't exist (and therefore never
sent the initial query) (Figure 3). By monitoring these
unsolicited responses, researchers can identify
denial-of-service attack victims and infer information about
the volume of the attack, the bandwidth of the victim, the
location of the victim, and the types of services the attacker
targets.
 |
 |
 |
|
Figure 1: The
attacker sends packets with spoofed source addresses to the
denial-of-service attack victim.
|
Figure 2: The
denial-of-service attack victim cannot differentiate
between legitimate traffic and the attack packets, so the
victim responds to as many of the attack packets as
possible.
|
Figure 3: Because
the network telescope composes 1/256th of the IPv4 address
space, the telescope receives approximately 1/256th of the
responses to spoofed packets generated by the
denial-of-service attack victim.
|
Many denial-of-service attacks do not use spoofed source IP addresses
in attacking the victims; the network telescope does not monitor
attacks utilizing legitimate denial-of-service attacks, and it may not
monitor attacks using non-randomly spoofed IP addresses.
For more information on monitoring denial-of-service attack backscatter,
see:
Internet Worms
Many Internet worms spread by randomly generating an IP address to
be the target of an infection attempt and sending the worm off to that
IP address in the hope that that address is in use by a vulnerable
computer (Figure 4). Because the network telescope includes one out of every 256
IPv4 addresses, it receives approximately one out of every 256 probes
from hosts infected with randomly scanning worms. Many worms do not
scan truly randomly, and network problems (both worm-induced and
independent) may prevent the network telescope from receiving probes
from all infected hosts. In general, though, the telescope sees a
newly infected hosts transmitting at the slow speed of 10 packets per
second within 30 seconds of its infection.
 |
|
Figure 4:
Infected computers randomly attempt to infect other
vulnerable computers. The network telescope monitors
approximately one out of every 256 infection
attempts.
|
For more information on monitoring the spread of Internet worms with the
network telescope, see:
Malicious Network Scans
Automated, semi-automated, and manual attempts to locate exploitable
computers on the Internet. Scans often differ from other types of
traffic visible on the network telescope because the scan traffic
arriving at the telescope is not driven by chance. Rather, the
attacker's byzantine motives in selecting scan targets appear
arbitrary from the perspective of the recipient of the scan. The
UCSD Network Telescope receives many types of scans continually,
including ping based scans for the existence of a device at a given
IP address, sequential scans of ports on a single IP address,
methodical scans for a single or a small number of vulnerable ports
sequentially through an IP address range, and even scans utilizing
TCP resets.
Telescope Data Access
Many privacy and security concerns are associated with Network
Telescope datasets. Because some viruses and worms involve the
installation of backdoors that provide unfettered access to infected
computers, telescope data may contain features that advertise these
vulnerable machines. Also, while the source of some types of
telescope traffic, including denial-of-service attacks and worms,
is readily apparent, a significant volume of traffic is of unknown
origin. Without identifying the traffic, we cannot assess the
security and privacy impact of releasing the data.
CAIDA makes available a number of datasets for researchers who wish
to study data collected at the UCSD Network Telescope. These
datasets represent the major sources of telescope traffic:
- Near-Realtime Data
- Denial-of-Service Attack Backscatter
- Worms
Research supported by Telescope Data
The UCSD Network Telescope data on Denial-of-Service Attack Backscatter and Internet Worms resulted in the following
publications by external researchers:
Cooperative Association for Internet Data Analysis (CAIDA)