your very own dark IP monitor

the guys at team cymru have posted instructions on building your own darknet sensor using freebsd. it even made slashdot one day. they construct flows using argus but could easily get flows from their router (and collect them with flow-tools, cFlowd, or SiLK tools). you could also do this with linux, openbsd, or your favorite UN*X variant.

the trick isn't in the construction, by the way, it's in the data analysis. and sadly they provide little in terms of how to analyze the data. you're left with an exercise, but there's no reason you couldn't implement some of the techniques for data analysis listed by projects like iSink, the IMS, or others.

i covered a lot of this already in my worms book. basically the whole concept of Dark IP, blackhole, or darknet space is a powerful monitor into your network. if you run a large network you can shunt off unused portions to a single collection system. if you're a home user (ie broadband) you have fewer possibilities, but you still have a few. bear in mind the larger the network you monitor the more data you collect and the harder your analysis becomes. i found that a combination of tools which distills the data in a near real-time fashion is the best approach. otherwise you spend too much time trying to dig back through old data and make sense of it. hence ... my involvement in projects like the IMS. hopefully our papers will be accepted at conferences and you can see the architectural details. plus i get a chance to test some algorithms i developed to detect and classify traffic.