The Spinning Cube of Potential Doom

Darknets are often proposed to monitor for anomalous, externally sourced traffic, and require large, contiguous blocks of unused IP addresses - not always feasible for enterprise network operators. We introduce and evaluate the Greynet - a region of IP address space that is sparsely populated with `darknet' addresses interspersed with active (or `lit') IP addresses. Based on a small sample of traffic collected within a university campus network we saw that relatively sparse greynets can achieve useful levels of network scan detection. Categories and Subject Descriptors C.2.3 [COMPUTER-COMMUNICATION NETWORKS]: Network Operations - Network monitoring General Terms Management, Measurement, Performance, Security, Verification.

• Type: Journal
• Year: 2004
• Where: CACM
• Authors: Stephen Lau
• Keywords: CACM 2004, Enterprise Network Operators, University Campus Network, Unused Ip