Cloud telescopes

A traditional Internet telescope monitors routed but unused address space. As services move to clouds and unused IPv4 space shrinks, less attack traffic reaches it.

DScope collects from the cloud itself. Collectors run on short-lived cloud VMs, complete TCP handshakes with incoming connections, and record packet captures. A pipeline organizes and archives the captures for later analysis. Compared with a traditional telescope, DScope received up to 450× as much cloud-targeted scanning as random scanning would predict. The yield of scanners per address peaked within 8 minutes of observation, so each address needs to be held only briefly.

In a 2025 IEEE Security & Privacy article, we examine whether conventional honeypots still capture the attacks aimed at clouds.

DScope is now an open data project operated by Terrace Networks; its data is at dscope.org.