LightScope: Turning Unused Production Ports into Global Network Telescopes and Honeypots#

Eric Kapitanski (USC Information Sciences Institute; advisor Jelena Mirkovic)

• Why: A genuinely new measurement vantage point for the network-security side of the PM's portfolio: as IPv4 dark space shrinks, this turns closed ports on live production hosts into telescope/honeypot sensors, with evidence it sees attackers that dark-space telescopes and honeynets miss entirely.
• What: A lightweight sensor (median 7.5% of one core / 191 MB RAM; 295+ nodes) deployed across 27 domains and 243 internet-reachable endpoints (UCSD 57, Internet2 46, SDSC 35, Nebraska 28, Amazon 15, plus DFN, SURF, Verizon, Deutsche Telekom and others). It answers TCP SYN attempts to unused ports on in-use IPs — addresses attackers already know about — forwarding sessions to an ISI honeypot with the adopter's IP anonymized (IRB-approved). Findings: scanning behavior clusters by Jaccard similarity of port sets (broad multi-domain scanners vs targeted single-domain scanning); LightScope observes scanner IPs exclusive to any passive telescope or residential honeynet, and exclusivity increases down the attack funnel (scanners → attackers that log in and run commands). Cross-check against commercial intel: of 13,667 IPs that logged into honeypot ports and ran commands, GreyNoise classed 74% as malicious and AbuseIPDB recommended blocking 58%.
• How: Agent on production hosts captures connection attempts to unused ports; analysis quantifies per-endpoint visibility and overlap with telescopes/honeynets using exclusivity and Jaccard metrics.
• Where applicable: Research and CSIRT measurement programs; any network can adopt the sensor. Limitations: TCP SYN only, no UDP or backscatter, deliberately capped resource use. The broader implication matters to anyone reasoning from telescope data alone: dark-space-only visibility is increasingly incomplete.