Darknets are well known as a place to look for Internet threats, but a presentation by RESTENA and CIRCL at this week’s TF-CSIRT meeting suggested they may also show up other kinds of problems. Darknets are parts of the IP address space that are routed but not used, so there should be no legitimate packets arriving at those addresses. Packets that do show up may relate to scanning, or be responses to attacks forged to appear to come “from” the darknet addresses.
