As services are increasingly centralized in public clouds, understanding the nature of Internet Background Radia- tion (IBR) hitting these particular environments is an important part of understanding their overall security posture. Classical network telescopes, long the cornerstone of IBR research, face hurdles here: their surface area is shrinking, and their well- known address ranges are easily avoided. We present a multi- cloud view of IBR in this paper. We deploy a passive, distributed network telescope with 336 IPs across five major cloud providers. We compare traffic from our cloud telescope with data from two classical telescopes, a large well-known (/9 + /10) and a small unknown /16, to analyze observational biases. To enable a fair comparison across very different telescope sizes, we tune a scan detection algorithm to determine appropriate thresholds. Our findings reveal that IBR in the cloud is strongly provider- dependent rather than geography-dependent, highlighting the necessity of multi-cloud deployments for comprehensive visibility of IBR in the cloud. Our cloud telescope also captures a distinct set of scanners, confirming that scanning activity is not uniform across the IPv4 space, and we confirm that small, distributed telescopes are ill-suited for observing random events like DDoS backscatter. Our work underscores that monitoring must evolve beyond classical telescopes to include diverse, multi-cloud vantage points to accurately capture IBR.

@inproceedings{kempen2026multicloud,
  author    = {Kempen, Nils and Mok, Ricky K. P. and Degen, Bernhard and Jafri, Syed Mujtaba and Holz, Ralph},
  title     = {A Multi-Cloud View of Internet Background Radiation},
  booktitle = {Proc. 10th Network Traffic Measurement and Analysis Conference (TMA)},
  year      = {2026},
  address   = {Delft, The Netherlands},
  publisher = {IFIP},
  isbn      = {978-3-903176-83-6},
  note      = {To appear},
}

Network telescopes (or darknets) have been a vital resource for learning about Internet phenomena for over 20 years. Unsolicited network traffic observed at a network telescope enables, among other things, tracking of Internet outages, botnets and DDoS attacks. However, IPv4 address scarcity and rising operational costs put pressure on operators to maximize use of their allocated space, potentially reducing the address space available for telescopes. In this paper, we examine how a decrease in address space affects what we can learn about the phenomena we study with telescopes. As a first step, we characterize traffic to three network telescopes that differ in size, distribution, and prominence. We find that most telescope address blocks observe a similar number of source IP addresses, but smaller telescopes offer higher visibility per monitored address. Additionally, we observe substantial overlap in sources at each telescope, indicating pervasive targeting of the IPv4 address space. As a case study of how reduced address space impacts one aspect of visibility, we examine how sensitive randomlyspoofed DoS attack inference is to the size of the address space under observation. We find that such inference benefits from larger telescopes, albeit with diminishing returns. Our findings support the viability of distributed network telescope deployments. Telescope operators can apply our methodology to assess visibility and guide dimensioning decisions.

@InProceedings{10.1007/978-3-032-18268-5_14,
author="Degen, Bernhard and Kempen, Nils and Claffy, K. C. and Mok, Ricky K. P. and Holz, Ralph and Rijswijk-Deij, Roland van and Sommese, Raffaele and Jonker, Mattijs",
editor="Ferlin-Reiter, Simone and Fontugne, Romain and Ullrich, Johanna",
title="Through a Smaller Lens: Revisiting Opportunistic Analysis Using Network Telescopes",
booktitle="Passive and Active Measurement",
year="2026",
publisher="Springer Nature Switzerland",
address="Cham",
pages="294--318",
isbn="978-3-032-18268-5",
doi="10.1007/978-3-032-18268-5_14"
}