Summary

  • Eric Kapitanski’s LightScope places a sensor on unused TCP ports of production hosts. Its optional honeypot mode forwards selected connections to a separate machine.
  • The RIPE 93 presentation says scanners choose among individual live endpoints in ways a dark-space sensor can miss. The 2026 study record covers two months and 235 deployments.

Analysis

A scan against an unused address answers one question: who knocks on a place with nothing running? A scan against a live server raises another: which machine does the scanner choose, and what does it try after the first packet? Eric Kapitanski built LightScope to watch that second boundary.

Dark address space has been a useful Internet telescope for years. But the pool of unused IPv4 addresses is getting smaller, and scanners may treat a block of empty space differently from a host that serves real users. LightScope moves the observation point onto that host without inspecting its running services.

The design uses spare TCP ports. In passive mode, LightScope records an incoming TCP SYN on an unused port. In the optional honeypot mode, an operator selects a subset of unused ports—Kapitanski said deployments commonly used 10 to 26—and the software forwards connections to a remote honeypot. The production machine does not host the decoy service; it acts as the door and relay.

That split matters. Traffic for the host’s real services stays outside the collection path. A connection that crosses the selected unused port reaches the separate decoy, where researchers can see what the scanner asks for next. The measurement moves closer to a live endpoint without turning the endpoint’s working service into a test target.

The official record for the 2026 Internet Measurement Conference paper describes two months of data from 235 LightScope deployments. In the RIPE 93 talk, Kapitanski walked through scanners that behaved differently across individual production hosts, even on the same network. A scanner could look familiar in a broad view while choosing only some live endpoints for a second line of probing.

That is the article’s useful distinction: a sensor does not just count traffic; its address and role shape the traffic it can see. An unused address can reveal a sweep. A live host’s unused port can reveal selection among real endpoints. A remote honeypot can then expose the attempted login or command sequence after a connection. Each step answers a different question.

Kapitanski said the deployment mix was heavily weighted toward US education networks; a broader operator and geography sample would change how far the endpoint-selection result can travel. The talk also names two blind spots: LightScope does not collect UDP traffic or backscatter. A TCP-only view cannot stand in for every scan or attack pattern.

The operator’s choice is therefore narrow and concrete. Which unused ports may become sensors? Which of them may forward a connection? Who receives the decoy logs, and how long do attempted credentials and commands stay there? A quiet port can become a valuable observation point, but only after someone decides what it is allowed to record.

Sources