A network telescope is a tool for monitoring poorly visible events on the Internet. The basic concept of its operation is monitoring traffic to inactive (i.e. dark) IP addresses. By analyzing such traffic, it is possible to gain insight into the activities of scanners and attackers, as well as any major cyberattacks that cause a large amount of backscatter traffic. Analogous to the size of the mirror of an astronomical telescope, a larger number of inactive addresses increases the resolution of the Internet telescope and thus the ability to observe smaller events. Since 2011, the Laboratory for Telecommunications at the Faculty of Electrical Engineering has been monitoring activity on a /24 segment of public IP address space (256 IP addresses) that have never been used, referred by a domain or published in connection with any service. Throughout the data collection period, we have noticed an exponential trend of increasing traffic and numerous changes in the sources and the type of traffic.

Spletna stran: telescope.ltfe.org/telescope/en/