Network telescope

The basic idea is to observe traffic targeting the dark (unused) address-space of the network.

Since all traffic to these addresses is suspicious, one can gain information about possible network attacks (random scanning worms, and DDoS backscatter) as well as other misconfigurations by observing it.

The resolution of the Internet telescope is dependent on the number of IP addresses it monitors.

The naming comes from an analogy to optical telescopes, where a larger physical size allows more photons to be observed.

[2] These include a greynet assembled from 210,000 unused IP addresses mainly located in Japan.