Summary

  • At RIPE 93, Muhammad Sangeen described a method that classifies an IoT or non-IoT scanner from one TCP SYN. It uses header fingerprints, chiefly receive-buffer settings, without probing the source or reconstructing a flow.
  • In a 30-day UCSD Network Telescope sample, his team classified IoT devices as roughly 6% of scanning hosts but under 1% of scan packets. A few high-volume non-IoT scanners dominated the packet count.

The source list tells a different story

A network operator ranks scanners by packet volume. The biggest bars demand attention. Sangeen's RIPE 93 research abstract asks who occupies the long tail beneath them. His team examined 30 days of UCSD Network Telescope traffic: 3.2 trillion packets from 10.8 million distinct sources. Its classifier put IoT devices at about 6% of scanning hosts, yet below 1% of scan volume. By volume, a handful of non-IoT systems towered over the plot. By number of sources, small devices appeared far more often.

The distinction matters at a CGNAT border or IXP mirror where an operator can observe traffic but cannot interrogate every originating device. Sangeen's method reads the opening TCP SYN. Receive-buffer configuration and other header choices become a fingerprint. The research combined exact matches with a classifier trained from 224 IoT devices across six testbeds and a separate non-IoT fingerprint database. For previously unseen devices it reported over 90% correct classification at a false-positive rate below 0.2%. These are performance figures for that evaluation, not a tag stamped on every packet in a live exchange.

Slow can be numerous

The telescope result changes a common triage habit. A volume threshold will catch the loud general-purpose scanner and miss many devices that each send few packets. Sangeen described the broad, slow IoT pattern as consistent with botnet behavior. The SYN fingerprint identifies a device class in the study; it cannot convict an individual device of compromise. At an operational border, repeated class signals and the actual target pattern would give the alert its meaning.

The RIPE RACI profile places Sangeen's work in Internet measurement at the University of Twente. His wager is practical: the first packet already carries enough configuration choices to ask a better question. A chart of packets asks which source shouted. A chart of sources asks how many small machines joined the chorus.

Sources: RIPE 93 original talk abstract; RIPE RACI researcher profile. Identity and portrait source: University of Twente staff profile; University of Twente captioned group photograph.