Revisiting and Revamping an IPv6 Network Telescope

Those who monitor network traffic are aware of the never ending stream of login attempts to servers that are, by necessity, on the public Internet. While working on dual-stack infrastructure for an Interreg Europe funded IoT project, and noting the volume of non-productive traffic, one of the authors was incentivised to revisit the monitoring of Internet background radiation. In particular, we conduct a comparison of IPv6 background traffic seen in 2006 using the same IPv6 network as a reference. We provide details of our darknet implementation, identify the types of traffic observed and its origin, and see an increase in traffic over our previous observations. The traffic, mainly ICMPv6, seems to relate to reconnaissance and Internet mapping.