Monitoring Systems White Papers
On the Design and Use of Internet Sinks for Network Abuse Monitoring
Overview Monitoring unused or dark IP addresses offers opportunities to significantly improve and expand knowledge of abuse activity without many of the problems associated with typical network intrusion detection and firewall systems. This paper addresses the problem of designing and deploying a system for monitoring large unused address spaces such as class A telescopes with 16M IP addresses. The paper describes the architecture and implementation of the Internet Sink (iSink) system which measures packet traffic on unused IP addresses in an efficient, extensible and scalable fashion. In contrast to traditional intrusion detection systems or firewalls, iSink includes an active component that generates response packets to incoming traffic. This gives the iSink an important advantage in discriminating between different types of attacks (through examination of the response payloads).
| Publisher | University of Wisconsin | File Format | |
|---|---|---|---|
| Date Published | February 2005 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 4 out of 7 users found this white paper useful
White Paper RSS
Download
Register
