Internet background radiation arrival density and network telescope sampling strategies

Internet background radiation capture and analysis provides a mechanism to detect attacks and measure the health of the Internet. In this paper we outline results from a /16 network telescope where we experiment with different sampling strategies and apply them to arrival density measurement. The results indicate that current network telescope deployments using contiguous address space allocation are not good at predicting IBR in adjacent address space. Three other address allocation mechanisms are studied and shown to predict IBR behaviour with a much greater accuracy. These more effective deployment and sampling strategies could be employed by ISPs or business users to create more effective network telescopes in the future.