Opportunistic Measurement: Extracting Insight from Spurious Traffic

While network measurement techniques are continually improving, representative network measurements are increasingly scarce. The issue is fundamentally one of access: either the points of interest are hidden, are unwilling, or are sufficiently many that representative analysis is daunting if not unattainable. In particular, much of the Internet’s modern growth, in both size and complexity, is “protected” by NAT and firewall technologies that preclude the use of traditional measurement techniques. Thus, while we can see the shrinking visible portion of the Internet with ever-greater fidelity, the majority of the Internet remains invisible. We argue for a new approach to illuminate these hidden regions of the Internet: opportunistic measurement that leverages sources of “spurious” network traffic such as worms, misconfigurations, spam floods, and malicious automated scans. We identify a number of such sources and demonstrate their potential to provide measurement data at a far greater scale and scope than modern research sources. Most importantly, these sources provide insight into portions of the network unseen using traditional measurement approaches. Finally, we discuss the challenges of bias and noise that accompany any use of spurious network traffic.