Telescope Traces and Heatmaps
IPv4 Address Space Maps
The following figure shows the mapping of the sources IP addresses of packets extracted from the telescope traces in November and December 2009; the labeled blocks are based on IANA's list of IPv4 allocations.
The IP addresses belong mostly to the address space allocated through the Regional Internet Registries: RIPE, APNIC, ARIN, LACNIC, and AfriNIC. The figure also shows some addresses in the areas labeled "Various Registries" indicating allocations from the former "class B" and "class C" before the mid-1990s.
Addresses in the areas labeled as "Unallocated", "Multicast", "Future use" and in the "class A" address blocks appearing in the upper left of the map are rare.
Figure 1. IPv4 address space map of the sources IP addresses of packets extracted from the telescope traces in November and December 2009.
Filtering only the packets sent to tcp port 445, representing on average the 70-80% of the telescope traffic we obtained the map in Figure 2.
Figure 3 evaluates the source address space of the remaining 20-30%. In the second case the figure shows a high similarity level with the figure representing the map of all the packets. The sources that send packets to the port 445 come from less widespread points of the address space map.
Figure 2 and 3. IPv4 address space map of the sources IP addresses of packets sent to port 445 (left) and sent to a port different from 445 (right).
The figures are obtained using the IPv4 Heatmap Software by The Measurement Factory.