How much is junk traffic costing you?

Your corporate network is probably dealing with millions more requests for information than it should be

A few weeks ago, a coworker asked me a simple question: How much of the Internet traffic coming into our network was "junk", and how much was this unwanted traffic costing us? Before delving too deeply into his request, I asked him to define the term junk. His classification included suspected port scans, attempts to exploit known weaknesses in applications, and attempted connections to TCP and UDP services on hosts that didn't provide those services.

He asked me to generate a list of offending networks that were the source of junk traffic in the past 30 days. At first, it seemed almost too easy. However, after only a few hours of work, I realised I had underestimated how involved a task it really was.

Finally, after a few days of work, I managed to produce a rather comprehensive list of IP addresses that were sources of junk data. I used a variety of means to gather this data, including NetFlow data, system log files, Snort, and a darknet.

In all, approximately 2.8 million distinct IP addresses from all over the world were responsible for junk traffic on my organisation's network in the past month. And keep in mind that this doesn't include delivered junk email.

Next, I needed to somehow organise these different IP addresses into networks and identify where all the junk was coming from. And this isn't exactly a simple task when you're dealing with so much data.

Since my first step was to aggregate the data, I decided to get a list of the delegated Internet networks from the FTP site of the American Registry for Internet Numbers (ARIN). However, ARIN uses the Border Gateway Protocol (BGP), and the smallest network I could focus on was a /24 or Class C network because of how BGP works.

An hour or two of coding and testing later, and I had an aggregation tool that ordered the junk-sending IP addresses into worldwide networks. Of the approximate 250,000 network paths obtained from ARIN and the 2.8 million junk-sending IP addresses, I had a list of roughly 40,000 networks that were responsible for junk traffic on my organisation's network in the past month.

Next, I used another program to separate the collected data by country into ARIN (North America, the Caribbean, and Southern Africa), APNIC (Asia and the Pacific region), LACNIC (Latin America and...

...the Caribbean), and RIPE (Europe, the Middle East, Central Asia, and Northern Africa) network information. That's when some interesting statistics began to emerge.

Statistically, the majority of junk IP addresses came from inside the United States, which isn't surprising. There are millions of Trojaned Windows systems on the Internet — especially on broadband networks — and the majority of these systems are in the United States. Hackers worldwide regularly organise large numbers of compromised Windows systems into "botnets" and use them for massive DoS attacks or other nefarious activities.

Second on the list for junk Internet traffic was China. This is somewhat ironic given the country's strict controls on Internet usage and the millions of dollars spent on the "Great Firewall of China".

It's a good bet, however, that China is more concerned about what's coming into the country via the Internet than what's going out — and that's probably why so many junk email organisations use Internet services in China. Anyone with a spam-trap email account can easily confirm that China is a major source of spam.

If someone wants to send junk email, there are plenty of places in China to send it from, and many spam reporting services can confirm this. In any case, the fact that so many China-delegated IP addresses scanned for SMTP and various TCP proxy services made it number two on my junk list.

Rounding out the top five on my list of junk Internet traffic sources were France, Belgium, and Germany. The remaining individual countries didn't make the bell curve for the top five, so I simply summed their totals.

Based on the total amount of incoming data for the 30 days in question, my report showed that approximately 7 percent of all incoming Internet traffic to my organisation's network fell under the junk traffic classification. Estimating the cost for bandwidth at about $50 per megabit per second, the junk traffic costs my organisation about $255 per month — or about $3,060 annually — that's about £1,760.

However, when compared to our total bandwidth costs, this amount is pretty inconsequential — and not worth doing anything about. The effort required to contact the people who manage the networks the junk comes from just wouldn't justify the expense, and most of them probably wouldn't do anything about the problem anyway. So, like many other Internet problems, the best solution to dealing with junk Internet traffic is to do nothing at all.

Story URL: http://news.zdnet.co.uk/communications/0,1000000085,39240811,00.htm