Monitoring any portion of the Internet address space reveals incessant activity. This holds even when monitoring traf c sent to unused addresses, which we term background radiation. Background radiation re ects fundamentally nonproductive traf c, either malicious ( ooding backscatter, scans for vulnerabilities, worms) or benign (miscon gurations). While the general presence of background radiation is well known to the network operator community, its nature has yet to be broadly characterized. We develop such a characterization based on data collected from four unused networks in the Internet. Two key elements of our methodology are (i) the use of ltering to reduce load on the measurement system, and (ii) the use of active responders to elicit further.
