Logo

The UCSD Network Telescope

The UCSD Network Telescope

The UCSD Network Telescope is a passive traffic monitoring system built on a globally routed, but lightly utilized /9 and /10 network. Under CAIDA stewardship, this unique resource provides valuable data for network security researchers.

Introduction

The UCSD network telescope is a sophisticated system that monitors one-way, passive Internet traffic directed toward the unused portion of a globally routed /9 and /10 IPv4 network, which is often referred to as a black hole, Internet sink, darkspace, or darknet. This network, allocated by ARDC, represents approximately 1/256th of all IPv4 addresses and carries almost no legitimate traffic due to its lack of provider-allocated IP addresses.

After filtering out legitimate traffic from the incoming packets, the remaining signal provides a continuous view of anomalous unsolicited traffic, commonly referred to as Internet Background Radiation (IBR). This traffic includes a mixture of signals resulting from various sources such as misconfigurations (e.g. mistyping an IP addressxx), malicious activities (e.g., scanning, probing, and backscatter from denial-of-service attacks), propagation of worms and viruses, and other unintended network behaviors. IBR is generally studied to gain insights into Internet-wide phenomena, including cybersecurity threats, vulnerabilities, and systemic misconfigurations. Traditionally, darkspace traffic was dominated by high-intensity scanning, backscatter from large-scale denial-of-service (DDoS) attacks, and worm propagation. However, in recent years, traffic destined for darkspace has increasingly included longer-duration, low-intensity events, some of which are associated with botnet operations.

CAIDA personnel maintains and expands the telescope instrumentation, collects, curates, archives, and analyzes the data, and enables data access for vetted security researchers. As a result, 299 publications were written using datasets generated from the UCSD Network Telescope.

Subnet Filters

The UCSD network Telescope is a passive monitoring system that captures Internet traffic sent to a segment of IP address space owned by Amateur Radio Digital Communications. The range consists predominantly of unutilized IP addresses, meaning they are not assigned to active hosts. It also encompasses a few utilized IP address blocks. We wrote a tool to filter out any legitimate traffic inadvertently captured. Our filtering process relies on an exclusion list obtained by querying a database maintained by ARDC. This list includes all address blocks allocated by ARDC for use, including some users that announce their prefix via the Border Gateway Protocol (BGP) into the global Internet. Theoretically, we should not receive traffic from these BGP-announced networks; this filtering is a preventative measure. As of November 2023, we have enhanced our operations by automatically updating subnet filters twice daily. Additionally, for historical reference, we archive all filters going forward (starting with the timestamp 1700517778) in a swift container named amprnet-legit-networks-all-subnets. This container also has files of daily filters before this time, but there is a gap where we had not updated the pipeline to use the new database querying mechanism, i.e., we were not performing this filtering accurately. Authorized users of the telescope data can access this historical information which may help analyze the data, as it indicates which prefixes we should not see traffic to because we filter it. I.e, those address blocks are not part of our darknet.

The telescope instrumentation is in need of an overhaul to keep up with traffic growth. System resource limitations sometimes cause packets to be dropped, or failure to generate flowtuples. We are in the process of upgrading the hardware and software to accommodate this growth.

IBR Origin

Denial-of-service Attacks

The UCSD network telescope can be used to monitor the spread of random-source distributed denial-of-service attacks. To make it difficult for the attack victim (and the victim’s ISPs) to block an incoming attack, the attacker may use a fake source IP address (similar to a fake return address in postal mail) in each packet sent to the victim (Figure 1). Because the denial-of-service attack victim can’t distinguish between incoming requests from an attacker and legitimate inbound requests, the victim tries to respond to every received request (Figure 2). When the attacker spoofs a source address in the network telescope, we observe a response destined for a computer that doesn’t exist (and therefore never sent the initial query) (Figure 3). By monitoring these unsolicited responses, researchers can identify denial-of-service attack victims and infer information about the volume of the attack, the bandwidth of the victim, the location of the victim, and the types of services the attacker targets.

The attacker sends packets with spoofed source addresses to the denial-of-service attack victim. The denial-of-service attack victim cannot differentiate between legitimate traffic and the attack packets, so the victim responds to as many of the attack packets as possible. Because the network telescope composes 1/256th of the IPv4 address space, the telescope receives approximately 1/256th of the responses to spoofed packets generated by the denial-of-service attack victim.

Figure 1: The attacker sends packets with spoofed source addresses to the denial-of-service attack victim.

Figure 2: The denial-of-service attack victim cannot differentiate between legitimate traffic and the attack packets, so the victim responds to as many of the attack packets as possible.

Figure 3: Because the network telescope composes 1/256th of the IPv4 address space, the telescope receives approximately 1/256th of the responses to spoofed packets generated by the denial-of-service attack victim.

We know of 11 papers relating to Denial-of-Service that have been written using telescope data :

Internet Worms

Many Internet worms spread by randomly generating an IP address to be the target of an infection attempt and sending the worm off to that IP address in the hope that it is in use by a vulnerable computer (Figure 4). Because the network telescope includes one out of every 256 IPv4 addresses, it receives approximately one out of every 256 probes from hosts infected with randomly scanning worms. Many worms do not scan truly randomly, and network problems (both worm-induced and independent) may prevent the network telescope from receiving probes from all infected hosts. In general, though, the telescope sees a newly infected hosts transmitting at the slow speed of 10 packets per second within 30 seconds of the infection.

Infected computers randomly attempt to infect other vulnerable computers. The network telescope monitors approximately one out of every 256 infection attempts.

Figure 4: Infected computers randomly attempt to infect other vulnerable computers. The network telescope captures approximately one out of every 256 infection attempts.

We know of 50 papers relating to Internet Worms that have been written using telescope data:

Malicious Network Scans

Scans are automated, semi-automated, and manual attempts to locate exploitable computers on the Internet. The scan traffic often differs from other types of traffic visible on the network telescope because it is not driven by chance. Rather, the attacker’s byzantine motives in selecting scan targets appear arbitrary from the perspective of the recipient of the scan. The UCSD Network Telescope observes many types of scans continually, including ping based scans for the existence of a device at a given IP address, sequential scans of ports on a single IP address, methodical scans for a single or a small number of vulnerable ports sequentially through an IP address range, and even scans utilizing TCP resets.

Accessing and Analyzing UCSD Network Telescope Data

With support from multiple funding sources, we have worked to lower the barrier to entry for researchers by making network telescope data more accessible and easier to analyze while maintaining necessary privacy and security safeguards.

Currently there are 21 Telescope datasets listed in CAIDA catalog:

Several historical datasets are available for download, either publicly or upon request. However, ongoing datasets containing sensitive information can only be accessed through a VM-based analysis platform, where users can bring their code to the data but cannot download unanonymized data to ensure security and privacy.

To further support researchers, CAIDA provides free access to U.S.-based and vetted foreign academic researchers and offers telescope data licensing to vetted, paying industry partners under restricted data-use policies.

We have compiled comprehensive documentation, including a user guide and tutorials, offering step-by-step guidance on accessing, processing, and analyzing telescope data.

Published research supported by Telescope Data

The UCSD Network Telescope datasets resulted in the following 299 publications:

Acknowledgments

Department of Homeland Security (DHS) National Science Foundation (NSF)

The UCSD Network Telescope project is funded by NSF award OAC-2319959 “Scalable Technology to Accelerate Research Network Operations Vulnerability Alerts”, . The project was originally funded by NSF award, (CNS 1059439) “CRI-Telescope: A Real-time Lens into Dark Address Space of the Internet”, and subsequently by NSF award CNS-1730661 “STARDUST: Sustainable Tools for Analysis and Research on Darknet Unsolicited Traffic”, DHS S&T cooperative agreement (FA8750-12-2-0326) Supporting Research and Development of Security Technologies through Network and Security Data Collection, Amateur Radio Digital Communications (ARDC) service agreement “Supporting AMPRNet and the UCSD Network Telescope”, and MIT Lincoln Labs service agreement.

Additional Content

UCSD Network Telescope Documentation Overview

Documentation Overview page

Published
Last Modified