Slashdot Mirror
Build A Darknet To Capture Naughty Traffic
DM_NeoFLeX writes "Have some routable Address Space lying around? You might want to build a DarkNet. The folks over at Team Cymru have outlined instructions for creating one with FreeBSD and as little as /32 routable space. From the article: 'A Darknet is a portion of routed, allocated IP space in which no active services or servers reside. These are 'dark' because there is, seemingly, nothing within these networks. Any packet that enters a Darknet is by its presence Aberrant.' Darknets can provide useful information for tracking the flow of naughty network traffic."
Woot!
Embrace the power of the darknet.
"Would you, could you, with a goat?" Dr Seuss
This is a really interesting idea, and I think I will have to look into it further. Anybody who would like to comment have something like this going on in a production environment?
-WS
An operating system should be like a light switch... simple, effective, easy to use, and designed for everyone.
The comments that follow are time-stamped proof of what you were all doing during working hours...
yoyoyoyoyoyoyo
like child porn, warez, etc etc ?
I thought that California had the market cornered on this during the energy crisis...
Do not look into laser with remaining eye.
Just as Luke Skywalker defeated Vader and the Darkside, the Lightnet led by the valiant hero Mr. Anonymous Coward PhD will vanquish the villianous foe known as Darknet.
darknet n. The collection of networks and other technologies that enable people to illegally share copyrighted digital files with little or no fear of detection.a sp
http://www.wordspy.com/words/darknet.
Slashdot doesn't award karma for funny moderation anymore, but you still get punished if a funny comment is modded down. If you post a funny comment (or a few funny comments) anonymously, and it's somewhat controversial so you get modded +15 funny, but -10 overrated/troll/offtopic, then you're screwed. Slashdot thinks you're a -10 troll, despite you actually being up on points.
Now, you're probably saying "Why not just post as your username?" Because the same principle applies, only to your account. If you're a funny person who some people don't get, you'll end up as a troll. Slashdot needs to get this fixed. If they don't want to count funny towards karma, fine, but don't punish people for being funny!
How do you track so called "naughty network traffic" when it goes to an IP with no services or servers? I guess you could do this with somthing along the lines of a "border" firewall (rather then a NAT system). But few of us have such a setup.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
most of the posters here are in school, and those that arn't i very much doubt many corps are gonna let you build secret porn networks with their infrastructure
It would seem like a good idea to use the info collected by the Darknet to perhaps automatically blacklist those offending IP addresses or perhaps to automatically complain to the offending ISP.
Does this mean Darknets are for pr0n?
<jedi> There is something funny here. You laugh. </jedi>
The Juniper (NetScreen/OneSecure) IDP has done a similar thing for years now.
You can assign it any IP and port combination, and it will ACK for any SYN's sent to it, whether there's a real server running on that IP or not. Such 'unsolicited' connections are a bad-traffic giveaway.
-AutoNiN
These are 'dark' because there is, seemingly, nothing within these networks. Any packet that enters a Darknet is by its presence Aberrant.
That's like the mailman trying to deliver letters to Santa Claus, or somebody addressing a letter wrong, thank good I know all those letters are Abberant now.
Your hair look like poop, Bob! - Wanker.
my penis when it penetrates my girlfriends vaginal cavity, it " is by its presence Aberrant."
and you can bet your bippy (who really knows what that means anyway) that we get kicked out of school if caught looking a things we oughtn't be.
I signed this
Come to the Darknet, little cracker; you know you want to.
Good, inexpensive web hosting
It's like a honeypot, except designed to catch worms, rather than live hacking attempts. Hell this could be extended with fake entries in a corporate address book to monitor worms that spread via e-mail communication.
I like the idea, and wish I had the corporate status to consider an implementation at my company.
I want an IP in the darknet!
I can hear the cry of the children everywhere!
Oh yeah! and whats an IP?
The Box is Open
why would a bunch of yanks in IL want a website with a name from Wales (UK), lets hope the Welsh assembly dont take it from em
Ok, it's a really good idea, but catching the naughty traffic isnt the hard part, what does it do witht he naughty traffic it gets, just make a pretty graph?
"Pushing little children, with their fully automatics, they like to push the weak around"
The analysis of the Witty worm (discussed on /. here ) used a massive darknet subtending 1/256 of the entire IPv4 address space. This gave them an excellent sample size for analyzing the behavior of the worm.
Two wrongs don't make a right, but three lefts do.
obtain a copy of End, we need you
Somehow I doubt ARIN and IANA will like this.
Sounds like a standard HoneyPot, except the only machine on the nextwork segement is a packet sniffer, so the address doesn't have any real destinations.. Not a big deal. I'm sure the honeynet people have done similar.
-molo
Using your sig line to advertise for friends is lame.
Using dark ip space, bogon space and so on for blackhole network monitoring has been in use for a while to help detect DDoS's and even network worms. Jose Nazario has written quite thoroughly and extensively about their usage in his book, Defense and Detection Strategies against Internet Worms. Check it out if this interests you.
An interesting use of a darknet would be to shield a real server from unwanted attacks. Have the darknet relate any internet IPs that contact the darknet to your real server to ignore.
As an example. Setup a darknet on the following IPs:
DARK_A : 204.210.34.1
DARK_B : 204.210.34.3
Setup the real server mathematically between the two darknet IP addresses:
REAL : 204.210.34.2
Now have DARK_A & DARK_B contact REAL whenever DARK_A or DARK_B receive any packets. REAL can be setup to, on the fly, filter out any packets received from the same source as the DARK servers reported.
In a sense you're creating a realtime blacklist. You can set the list on a timed delay to expire. Or even filter out specific packet signatures instead of entire suspect IP addresses.
just a thought...
Joseph Elwell
Let's get all those cliche'd jokes off in one go...
In you know where, the dark net sniffs you...
I'm for one, welcome our new darknet overlords
I have a whole list of bookmarks for my naughty traffic.
Seriously, though... I have a spare wireless router set up at work that's easily hacked, easily found, and logs every damn thing that touches it. Our real wireless network is obscured, encrypted, mac filtered, etc. I realize it's not technically the same thing as the post describes (I guess you'd call it a honeypot network or something) but it's the same idea.
Of course, nobody will care if a hacker makes his way into our network (honeypot or not) unless he does some "damage."
Hey! Who knew that the net was missing?
To-do List: Receive telemarketing call during a tornado warning. Check.
What's the difference between a darknet and a honeypot/net setup? Both seem to have the same goals, and both use some IP space to detect potential attacks.
... people used to speak RUSSIAN.
who saw their web site and was transported back to 1996? I half expected a looping MIDI background song, and a request for some obscure, obsolete plugin, or maybe a Netscape 3 Now! button.
Seriously, if anyone from there is reading this, ditch the ugly background image, and get some up to date design!. Sheesh. Just like a Welshman to have an ugly webpage.
...there are easier ways of finding Pr0n aren't there? Like opening up your spam folder :-)
These posts express my own personal views, not those of my employer
But why do I keep getting packets from Microsoft?
If you find this post offensive, don't read it! THINK ABOUT YOUR BREATHING! I am what I am because of how apes behave.
The idea here is to catch traffic to otherwise unused network addresses. This does not require any of the stuff that seems to be implied here.
For example, say you have a Linux system in a colo somewhere (or on the end of a T-1 or some other >1 IP address static network). You have some IP addresses assigned to you that are otherwise not assigned. Here is how you can get all of the darknet functionality with your standard server.
Some example numbers (none of which are real)
Unused address to watch: 10.11.12.13
Interface on which you receive traffic: eth0
A fake interface to route to: tap0
Configure your server to ARP the extra addresses:
arp -Ds 10.11.12.13 eth0 -i eth0 pub
Setup a "tap" device to route the traffic to
tunctl -u nobody -t tap0
ifconfig tap0 10.11.12.13 netmask 255.255.255.0 broadcast 10.11.12.255 up
Setup a "route" to the device
ip route add 10.11.12.13 dev tap0
At this point the traffic should all route to the fake device tap0. You can run tcpdump on this, setup IP filter chains, run MRTG on it directly, etc. All without any extra hardware.
For those that work with UML (User Mode Linux), you already recognize this is exactly how you setup virtual UML networks.
This is also somewhat related to "tar pits" that just answer connect requests to addresses that have un-completed ARP requests.
Have fun.
When all those Islamic towel-heads destroy the "great Satan" that is Western culture, the fruits of prosperity will cease and the world will fall into civil decay and revert back to barbarianism.
You see, that colored race which roams the desert looking for ways to destroy us does not realize that we are the only source of progress in philosophy, science, and art. Without America and its good, wholesome Christian values, this world would have nothing. There will be no one left to drive the human race towards perfection.
Once we've been destroyed by these short-sighted individuals, humanity will slowly fall into its doom. Afterall, the arabic peoples won't stop until everyone else is destroyed, then, like animals (I don't even think they're people), they will destroy themselves.
How can a violent race like that ever spawn social progress? They're quite literally like monkeys, running around like crazy, flinging feces at each other. Without Truth (the Word of God), they've gone quite insane with the devil whispering in their ears. Unlike monkeys flinging feces at each other, they fling bombs at each other (and us).
Personally, I'm glad that a good Christian man (women really can't be Good, because they cannot be like God as they lack the proper equipment), like George Walker Bush, has the guts to stand up and say "we won't let these inferior people destroy America". Now we're taking steps to exterminate them and take their resources for the advancement of America. Good show, Bush!
(Negative moderation will be considered religious persecution.)
I thought that Darknet was that new, badly named interacial pr0n site.
Damn those spamming bastards. Take my $49.99 will they?!
These things have been around for awhile, but known as Network Telescopes. The largest (AFAIK) is at UCSD, which is just a tad larger than a /32 (like, say, a /8). They collected some interesting data off the thing during all the Blaster rampages (Google cache of HTML'ed PDF here).
Also, see the NANOG guide to setting them up here, and the home for the CAIDA/UCSD telescope here.
So in short, nice job to the Welsh for implementing it, but there's bigger elsewhere for y'all to play with.
Cue The Sun...
Naughty will always triumph over good because good is dumb!
Oh I'll show you Post-Grad at brown you school hopping feind!
Bill Gates runs his own darknet to collect naughty things so he can stroke is microshaft at night...
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dying
Like, traffic that didn't pay it's taxes or something?
Get paid to search..It's geniune and
I'm New Here
Well, yes it's 10.0.0.0
but I control it...and that's what's important.
Ok, well...yes, I only control it on my side of the router...
sniff...nevermind
Malda's mother is a demon in the sack
How is this different than what Lance and the Honeynet ( http://project.honeynet.org ) team are doing?
"Omnis tuus capsa sunt inesse nos"
You ass.
It's got the info it needs, and that's all. Must be a member of the Bandwidth Conservation Society. Fine with me.
Wouldn't this be impossible to create with IPv6? Because of the *huge* address space and the negligible probability of a packet entering a darknet?
This is in no way an argument against IPv6, I'm eagerly awaiting it - I'm just curious...
I would definitely recommend trying this sometime, if you don't have a great router (like I do at home *kicks his netgear*) then you can use something like this to watch things, you never know what kind of interesting things you might find (worms anyone?) I've actually found a few odd things using this, such as a windows worm on one of my Windows boxes that I wasn't aware of and that was scanning my whole network. So consider using one of these, you never know what you might find. And kudos on the directions, they are very well done.
Sounds cool, but I wonder what the FEDS would think.
Since the honeynet was borderline illegal depending on how you set it up(interception of communications is a federal crime) this could also fit that bill.
Santa Claus
North Pole, Canada
H0H 0H0
If you write Santa at this address, he will write back. Not 100% sure USPS will send it over the border, but if they do, it'll work.
( Canada Post sends out replies to children each year; I think employees at the post office volunteer and take the time to hand-craft a personal reply to each and every letter, though they may be auto-generated nowadays, i am not certain ).
...is the uptime, no one can make it beyond 99 minutes!...
Sorry guys, couldn't resist...
The only problem with DarkNet is that they keep recommending *BSD, a dead OS! To wit:
.005% of internet servers. A recent attempt at a face-to-face summit in Boulder, Colorado culminated in an out-and-out fistfight between core developers, reportedly over code commenting formats (tabs vs. spaces). Hotel security guards broke up the melee and banned the participants from the hotel. Two of the developers were hospitalized, and one continues to have his jaw wired shut.
Yet another sickening blow has struck what's left of the *BSD community, as a soon-to-be-released report by the independent Commision for Technology Management (CTM) after a year-long study has concluded: *BSD is already dead. Here are some of the commission's findings:
Fact: There are almost no FreeBSD developers left, and its use, according to Netcraft, is down to a sadly crippled
Fact: the *BSDs have balkanized yet again. There are now no less than twelve separate, competing *BSD projects, each of which has introduced fundamental incompatibilities with the other *BSDs, and frequently with Unix standards. Average number of developers in each project: fewer than five. Average number of users per project: there are no definitive numbers, but reports show that all projects are on the decline.
Fact: X.org will not include support *BSD. The newly formed group believes that the *BSDs have strayed too far from Unix standards and have become too difficult to support along with Linux and Solaris x86. "It's too much trouble," said one anonymous developer. "If they want to make their own standards, let them doing the porting for us."
Fact: DragonflyBSD, yet another offshoot of the beleaguered FreeBSD "project", is already collapsing under the weight of internal power struggles and in-fighting. "They haven't done a single decent release," notes Mark Baron, an industry watcher and columnist. "Their mailing lists read like an online version of a Jerry Springer episode, complete with food fights, swearing, name-calling, and chair-throwing." Netcraft reports that DragonflyBSD is run on exactly 0% of internet servers.
Fact: NetBSD, which claims to focus on portability (whatever that is supposed to mean), is slow, and cannot take advantage of multiple CPUs. "That about drove the last nail in the coffin for BSD use here," said Michael Curry, CTO of Amazon.com. "We took our NetBSD boxes out to the backyard and shot them in the head. We're much happier running Linux."
Fact: *BSD has no support from the media. Number of Linux magazines available at bookstores: 5 (Linux Journal, Linux World, Linux Developer, Linux Format, Linux User). Number of available *BSD magazines: 0. Current count of Linux-oriented technical books: 1071. Current count of *BSD books: 6.
Fact: Many user-level applications will no longer work under *BSD, and no one is working to change this. The GIMP, a Photoshop-like application, has not worked at all under *BSD since version 1.1 (sorry, too much trouble for such a small base, developers have said). OpenOffice, a Microsoft Office clone, has never worked under *BSD and never will. ("Why would we bother?" said developer Steven Andrews, an OpenOffice team lead.)
Fact: servers running OpenBSD, which claims to focus on security, are frequently compromised. According to Jim Markham, editor of the online security forum SecurityWatch, the few OpenBSD servers that exist on the internet have become a joke among the hacker community. "They make a game out of it," he says. "(OpenBSD leader) Theo [de Raadt] will scramble to make a new patch to fix one problem, and they've already compromised a bunch of boxes with a different exploit."
With these incontroverible facts staring (what's left of) the *BSD community in the face, they can only draw one conclusion: *BSD is already dead.
Now when I type a wrong IP address, John Asscroft will be on my ass....
That's true. As a matter of fact I do happen to have an /32 ip block
("/32 routable space," if you will,
or a "Class D network"
with subnet mask no less than 255.255.255.255)
and also another /8 one--namely 127.0.0.0/8--a real Class A network
with subnet mask of 255.0.0.0,
i.e. all IP addresses from 127.0.0.1
up to 127.255.255.255,
exactly 16777215 (sic!) routable IP addresses,
which I proudly administer, and which happily
"capture naughty traffic" on a daily basis
(like there was no tomorrow, in fact)
thanks to images.google.com.
That is why I find this article especially interesting
and insightful.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
It's also called a network telescope. CAIDA has been implementing this type of thing for several months.
would be a better name since HoneyPots have been discussed for quite some time. And they are probably a bit safer than HoneyPots from a legal perspective (probably less you can do than compromising a HoneyPot machine).
Down at SDSC they have a little less than 1% of ALL of the routable IP space dedicated to doing this stuff. They call it a network telescope, and use it to study DOS activity and stuff.
http://www.caida.org/analysis/security/telescop
"Inferring Internet Denial-of-Service Activity" [2001] is good reading.
...can anyone say "omg hax"?
I completely agree, after spending countless hours sifting through log files, tweaking triggers to help reduce the amount of false positives, the IDS is not the complete answer.
An IDS is only so efficient, you need to first really understand your network before deploying, and even after deployment, this is only the beginning.
We have been using Darknets, or honeypots for sometime, an excellent combination of tools, see Snort, ACID (Analysis Console for Intrusion Databases
As said before and in the article, this is a sophisticated set of tools and you need to understand your network, or you will find yourself chasing ghosts, Enter the Darknet (Honeypot).
Combined with the other tools, we have been using Honeyd , an excellent honeypot, simple to get up an going and very configurable.
Snort.org has an excellent howto documentation to get the IDS up an going, then you can add the honeypot.
It can be downright humorous how quickly you will begin to capture useful information. In addition, adding scripts to interact with the traffic will allow you to keep the user busy while you are collecting data, or Tarpitting the traffic making the port "sticky" dragging the connections, another good one would be LeBrea.
If you have any interest in network security, or simply want to monitor your home network, you need to take a look at darknet, or any of the other tools mentioned.
In Soviet Russia, the Darknet scans you.
All your data packets are belong to us!
Has darknet coming out of his anus.
This is just like this issue of.
Weird.
You say things that offend me and I can deal with it. Can you?
How else would pidgeons be able to carry them? RFC 2549
Or at least, it's only really client-server in passive mode. The rest of the time, it's two servers talking to each other in the dumbest, most broken way imaginable.
(And if you have no idea what I'm talking about, examine the mechanics of the PORT command. And understand why firewall designers the world over just wish everybody would switch to WebDAV over HTTPS, or sftp, or some other equivalent, so we could pretend FTP never existed.)
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
"Otaku unite." -
Niira - nayami@anime-chat.com
A darknet is just one tool that is useful in a Service Provider environment, this presentation contains a lot more (BGP, honeypots, worm and DDoS detection, etc):
PDF
PPT
shut the fuck up
Slow Down Cowboy! Slashdot requires you to wait 20 seconds between hitting 'reply' and submitting a comment. It's been 19 seconds since you hit 'reply'. Chances are, you're behind a firewall or proxy, or clicked the Back button to accidentally reuse a form. Please try again. If the problem persists, and all other options have been tried, contact the site administrator[fat fuck cowboi kneel].
Slap it on the nose with a newspaper and say, "Bad! Bad packet!"?
it would be a trap net. If anything were to wander it's way, it'd be logged, and investigated. Anything that regularly scrubs the internet will trip on one of these addresses, sooner or later. Hopefully... if the trap addresses are actually spread around, and not just in the same basic network address...
:)
Hmm... I wonder what'll happen when googlebot drops by for a visit...
I have one IP address that runs a FreeBSD 4.10 WWW and FTP server. Basically any traffic for other ports is "naughty", and I get plenty of it. So much so that the I had to patch the ipfw2 PR where the default log limit cap wasn't working. The SMB ports usually hit the limit first, then the deny all rule at the bottom.
Also any anonymous FTP attempt is considered "naughty" as I don't do anonymous, nor do I advertise FTP anywhere. No domain name like ftp.foo.com, or ftp URIs to the IP address. So there is no reason, other than port scans for that traffic. Occasionally I look at the logs and e-mail ISPs of the more persistent probers. But mostly I just shake my head, and worry about my parents AOL dial up XP box.
And I'm sure I could do something with some of those ugly URLs my Apache server laughs at. Anyone got a good Apache2 module that emulates the IIS bugs to honeypot an attacker? That might be amusing.
More than a decade ago we built a "darknet" out of several unused class A addresses which we had access at the time. This was an experiment and we coordinated with the right network operators and funding agencies to make it all right. All networks were routed to our capture network containing only a packet sniffer. We kept the network in place for a month. The result: an amazing variety of "broken packets" which one Internet guru dubbed "bogons" arived at a low but constant rate. The three class A networks allowed us to see effects across part of the network address "spectrum:" we noticed, for example, that some bogons from the same host showed up on all three networks, spreading broken packets across the address space! We traced many bogons to bad UNIX ports and could, in some cases, locate the specific porting error responsible. Big and little endian problems accounted for many. A lot of people ran these broken ports and, due to the random luck of their address assignment, the port generated orphaned bogons onto our three class A networks. and hence to our darknet. One day we captured bogons containing commands for a distributed database. We traced it to a development lab run by a large computer manufacturer who thought no one knew that they were working on a new distributed database product. We were able to discover the origin and cause of many bogons, however, in the majority of cases we could not establish the bogon's cause or its origin. Our "darknet" experience showed a constant low level chatter of bogons througout the Internet. There are no "silent" slots in the address space, unused, where no one routes traffic. Unexpected things arrive and await discovery.
D'oh! At first I wondered why /. was posting about capturing naughty pictures by using driftnet with webcollage.
I tried this once but my screen's too visible to my boss whenever he snoopes around the cubefarm. The first porn pic I saw I decided I'd better shut webcollage down.
I'm glad someone's having fun. But they're either braver or dumber than me
Come play free flash games on Kongregate!
Also, you're increasing the overhead by requiring the packet filter to read the content of packets, instead of just their headers. That means slower throughput, especially when dealing with large networks.
And finally: FTP's the only protocol designed in this ultra-stupid way in the history of IP. FTP is so obviously a relic from the days when .edu was the dominant TLD in other ways, too, like cleartext passwords (ugh).
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
How does this differ from a honey pot?
There's no shame in being a pariah. -Marge Simpson
Scratch that I meant honey net
There's no shame in being a pariah. -Marge Simpson
Just a morality crisis with Enron whores raping grandma of her pension money. http://www.sundayherald.com/42433 Enjoy.
This ain't no upwardly mobile freeway This is the road to hell
This could be a useful tool if it were added to an Anti-virus program. The AV software could track known portions of the DarkNet, especially behind a Router, and wait for any process to fire off at part of the Dark - if it does, prompt to kill it, or just kill it, depending on a user pref.
Many many viruses prefer random blasting to IPs, even some who mix that with IP collection. It would catch a lot of viruses in the act - partly because a virus would have to be that much more complex, that it would have to have a reliable way of collecting good IPs before attempting to spread.
McAfee? Symantec? Are you listening? Add this instead of big heavy overreaching scans that crash apps. Are you there?
The Cymru Darknet is something entirely different, and it's not a honeynet either. Honeynets are nice sticky traps waiting to snare actively attacking crackers. This Darknet is primarily a passive monitoring system, and while it will see some active attacks such as port scans, another interesting thing it sees is backscatter from forged traffic, like CAIDA's System is tracking. Many DOS attacks use spoofed packets from random addresses, such as ICMP or SYN floods, and the victims or some routers will send TCP ACKs or ICMP responses back to the (forged) source, and some proportional fraction of that will end up in your darknet's detectors. It won't catch all such attacks - ISPs that want to be good citizens run the RFC2267 / RFC2827 best practices like uRPF spoof-proofing, which prevent their customers from forging packets except from the forger's own subnet address space, so you won't see those, but they're usually much less of a problem because they're easier to block, trace, and shut down. (Some of the cracker tools out there have built-in options to only forge within your /24 for just this reason.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
So if there are ostensibly no servers or workstations in this submet and it vacuums up all traffic, then it's more of a Blackhole Net. A Honeynet is designed to have fake info and traffic to lure in the hungry cracker, a P2P net is designed to easily share info, the Internet is apperently very good at hooking disparet networks (or spreading penis enlargement pills, no that's my email), and sneaker net is running floppies between computers to share info.
Blackhole Net, where the packets get in, but they don't get out!
--Somewhere there is a village missing an idiot.