Join us at hack.lu 2026 — Info & Registration
Duration: 90 min
Type: Workshop
Speakers: Paweł Pawliński, Jan Adamski, Jakub Koman, Paul JUNG
Abstract
Network telescopes capture vast amounts of unsolicited Internet traffic, much of which is often dismissed as background noise. In reality, this traffic contains valuable information about Internet-wide scanning, botnet activity, exploitation attempts, misconfigurations, data leaks, DDoS activity, and more.
The workshop will introduce the approaches used by CIRCL and NASK/CERT.PL to extract useful information from network telescope, while also leaving ample time for independent experimentation. Participants will leave with a practical understanding of how to turn seemingly meaningless packets into observations of large-scale Internet phenomena and actionable threat intelligence.
Description
In the first part of this workshop, we will draw on the experience operating and analysing large network telescopes at NASK/CERT.PL and CIRCL. We will present the collection and processing pipelines, explain how raw packets are transformed into structured and enriched datasets, and walk through real-world examples showing how Internet noise can be turned into actionable cyber threat intelligence. We will also compare observations from different telescope environments and discuss both the strengths and limitations of this data source.
The second part will switch to a hands-on, hackathon-style format. Participants will receive access to selected telescope datasets and analysis tools and will be encouraged to explore the data, formulate hypotheses, identify unusual behaviour, and investigate findings that capture their interest. The instructors will provide guidance and technical support, but there will be no predefined workflow or expected outcome. The goal is to recreate the exploratory process researchers use when analysing previously unexplored Internet traffic.
Requirements: Participants should bring a laptop and have a basic understanding of network protocols (layer 3 and above).