Classifying Internet One-Way Traffic
Internet Background Radiation (IBR) is a very interesting piece of Internet traffic as it is the result of attacks and mis-configurations. Previous work has primarily analyzed IBR traffic to large unused IP address blocks called network telescopes. In this paper, the authors build new techniques for monitoring one-way traffic in live networks with the main goals of expanding their understanding of this interesting type of traffic towards live networks as well as of making it useful for detecting network service reachability problems. Their first contribution is a comprehensive classification scheme for dissecting one-way traffic into useful classes, including one-way traffic due to unreachable services, scanning, peer-to-peer applications, and backscatter.