CNS Research on Network Telescope Visibility Accepted to PAM 2026

Researchers from the Center for Networked Systems (CNS) have had a paper accepted to the Passive and Active Measurement Conference (PAM) 2026, a leading venue for Internet measurement research. The work is led by CNS faculty member k claffy and researchers affiliated with CAIDA.

The paper, “Through a Smaller Lens: Revisiting Opportunistic Analysis using Network Telescopes,” investigates how shrinking IPv4 address space affects the visibility and effectiveness of network telescopes (darknets) used to observe unsolicited Internet traffic and monitor global security threats.

Research Overview
Network telescopes—unused but routable address space that passively collects unsolicited traffic—play an important role in identifying Internet-wide phenomena such as scanning activity, outages, botnets, and distributed denial-of-service (DDoS) attacks. However, increasing IPv4 scarcity and operational costs are reducing the address space available for telescope deployments.

To understand the impact of these changes, the researchers conducted a targeted replication of a seminal study from a decade ago, analyzing traffic observed across three network telescopes of different sizes, locations, and deployment strategies.

Key findings include:

High visibility from smaller deployments: Smaller telescopes can provide strong visibility per monitored address, offering efficient alternatives when address space is limited.

Pervasiveness of Internet-wide scanning: A substantial fraction of sources target the IPv4 address space broadly, with many contacting multiple telescope blocks within short time windows.

Framework for future deployments: The study provides a methodology for quantifying how telescope size affects measurement capability and outlines directions for future Internet security measurement infrastructure.

Why It Matters
For researchers and industry practitioners, the work provides new insight into the reliability and scalability of passive Internet measurement infrastructure under increasing resource constraints. The findings help inform the design of future cyber threat intelligence systems and large-scale network monitoring strategies.

The paper includes data from major network telescope deployments, including infrastructure operated by CAIDA at UC San Diego.

Read the full paper: https://www.caida.org/catalog/papers/2026_through_smaller_lens/through_smaller_lens.pdf