Comparative Analysis of SNMP Background Traffic in Two European Network Telescopes

Disclaimer

Co-funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Cybersecurity Competence Centre. Neither the European Union nor the granting authority can be held responsible for them.

Distribution and License

The document is distributed under Creative Common Attribution 4.0 International CC-BY.

The document is distributed as TLP:CLEAR.

Abstract

A network telescope is a passive measurement infrastructure that monitors routed but otherwise unused IP address space. Because no legitimate services are expected to communicate with these addresses, the traffic received by such a telescope is generally interpreted as unsolicited background activity, including Internet-wide scanning, malware propagation attempts, misconfiguration leakage, backscatter, and protocol-specific probing. In this context, SNMP packets observed by a telescope do not represent normal management exchanges with active devices; rather, they provide a large-scale view of how SNMP is abused, tested, or accidentally exposed across the Internet.

The FETTA project provides an opportunity to compare network-telescope observations across European partners using a common analytical approach. CIRCL is Luxembourg’s Computer Incident Response Center, while NASK, the Polish Research and Academic Computer Network (Naukowa i Akademicka Siec Komputerowa), operates through CERT.PL as Poland’s national cybersecurity and incident-response capability. By comparing their respective telescope observations, this work examines how the same class of unsolicited SNMP background traffic can appear differently from two European vantage points.

This work is the logical continuation of the earlier D4 analysis of large-scale IPv4 blackhole SNMP behaviour, Learning from Large-Scale IPv4 Blackhole: Behavioral Analysis of SNMP Traffic. Whereas that study established a behavioural and methodological baseline for SNMP traffic observed from a large passive telescope, the present analysis extends the perspective by comparing two European network telescopes under the FETTA framework.

This document analyses SNMP traffic observed in the NASK and CIRCL datasets for the period 1 July 2025 to 31 January 2026. The analysis focuses on packet volume, SNMP version distribution, community strings, temporal activity, autonomous-system patterns, vendor OID targeting, and source geography. The evidence indicates that both sensors observe the same broad phenomenon, namely unsolicited Internet-wide SNMP probing, but with markedly different composition and density.

Methodological Scope

The comparison is limited to the fields available for the shared observation window: SNMP version distribution, packet activity, community strings, source autonomous systems, vendor OIDs, scanner-like behaviour, source ports, and country-level statistics. Both network telescopes used the same PCAP conversion and extraction methodology, which makes the resulting fields directly comparable and reduces the risk that observed differences are caused by divergent processing pipelines. Some CIRCL measurements are not available in the same structured form as the NASK measurements, most notably the CIRCL table for top AS by packet count. Where a value is unavailable, this analysis treats it as a data gap rather than substituting values from another dataset.

The observations should be interpreted as measurements of unsolicited Internet background activity. Since network telescopes monitor address space that is not expected to host active services, received packets are better understood as scanning, leakage, misconfiguration, backscatter, or protocol probing rather than legitimate management traffic.

A specific methodological caveat applies to the CIRCL telescope: its address space is located one bit away from an RFC1918 private range. This proximity makes the telescope notably exposed to pollution from misconfigured systems, leakage, and traffic intended for private addressing contexts. CIRCL observations should therefore be interpreted with this background noise in mind, especially when analysing anomalous or highly repetitive traffic patterns.

Quantitative Overview

The most significant numerical contrast is not the total volume, but the protocol-version composition. CIRCL observes about 18.9% more SNMP packets than NASK during the shared observation period, but the two sensors differ more strongly in protocol mix: NASK is dominated by SNMPv2c with a substantial SNMPv3 component, whereas CIRCL is dominated by SNMPv1 and has only a small SNMPv3 share.

This volume difference is particularly striking because the NASK telescope is approximately 10 times larger than the CIRCL telescope. Despite this larger monitored address space, NASK receives fewer SNMP packets in absolute terms. Normalised by telescope size, CIRCL therefore receives roughly 11.9 times more SNMP packets per monitored address than NASK over the same period. This supports the interpretation that CIRCL’s observation point is exposed to a much denser SNMP background signal, which may include a stronger component of misconfiguration-related pollution.

This divergence is analytically important. SNMPv1 and SNMPv2c expose community strings and queried OIDs in clear text, making them directly useful for behavioural analysis. SNMPv3, however, can hide authentication and payload details, which reduces the visibility of community strings and OID intent. Consequently, NASK’s higher SNMPv3 share may indicate exposure to a different class of scanners, including scanners that probe for SNMPv3 availability or traffic whose detailed intent is less visible from packet metadata alone.

Temporality Analysis

SNMP Packet Activity

NASK

CIRCL

Community String Behaviour

In SNMPv1 and SNMPv2c, the community string is visible in the packet and functions as a weak shared secret. This makes v1/v2c traffic particularly useful for analysing scanner behaviour, because the community value often reveals whether a source is using generic defaults, vendor defaults, or more targeted guessing strategies.

The visible community-string distributions show that both sensors observe the expected dominance of weak or default SNMP communities, but the concentration differs.

NASK’s community-string distribution is almost entirely concentrated on public. The tail contains expected weak strings such as private, cisco, rmon, default, write, secret, manager, and test, but at very low individual frequency. This suggests broad opportunistic probing where the primary assumption is that exposed devices still accept the historical read-only default community.

CIRCL also shows public as the dominant community, but its distribution is less concentrated. The presence of internal, canon_admin, epson, and multiple vendor- or operator-looking strings suggests a richer mix of targeted defaults and possibly device-family-specific probing. The CIRCL data therefore appears more heterogeneous in visible v1/v2c community usage, while NASK appears more concentrated around a single default community.

The source population behind non-public community probing appears limited. On the NASK side, the same small set of sources tends to recur in a relatively stable way, especially around specific community/OID combinations. On the CIRCL side, the sources associated with less common communities appear more random and less stable. This suggests that, outside the dominant public community, only a relatively small number of actors or misconfigured systems systematically probe SNMP with alternative communities. CIRCL’s higher hit volume should therefore not be interpreted only as a larger scanner population; it may also reflect dataset pollution linked to the telescope’s proximity to an RFC1918 range and the resulting exposure to misdirected or misconfigured traffic.

Source Network and Autonomous System Patterns

The source-AS comparison points to different populations of emitters. The following table compares the top 15 autonomous systems by number of distinct source IPs observed from each side.

The NASK source-IP distribution is more concentrated in a small number of Asian network and hosting ASes. CIRCL’s top source ASes are more mixed, combining large Chinese networks, cloud providers, mobile networks, and commercial hosting platforms. This distinction is operationally important because AS-level analysis separates cloud providers, hosting providers, mobile networks, and access networks that may otherwise be hidden inside broad country-level summaries.

The NASK packet-volume table shows a different ranking from the distinct-source table. Its top packet emitters include HURRICANE, GOOGLE-CLOUD-PLATFORM, SonderCloud, reserved AS space, HK Kwaifong Group, AMAZON-AES, DRIFTNET, Microsoft, NETIFACELLC, and CT-HANGZHOU-IDC. This difference between distinct IP count and packet volume is expected: a large number of sources does not necessarily imply the largest traffic volume, and a small number of persistent scanners can dominate packet counts.

Country-Level

At country level, the two observations point to broadly similar source geographies. The exact rankings differ, but the recurring countries are largely the same: China, Hong Kong, the United States, Korea, Great Britain, Singapore, Poland, Germany, and several other European or hosting-heavy locations. This suggests that the two telescopes are exposed to the same general Internet-wide SNMP scanning ecosystem, even if routing, address-space placement, and local telescope characteristics change the order and weight of individual countries.

The country-level view should therefore be interpreted as a coarse geographic signal rather than as evidence of a fundamentally different source population. The stronger analytical value remains in combining country with AS, community string, OID, source-port, and temporal behaviour.

Operationally, country-level attribution is useful for prioritisation and training, but it should not be used alone for actor inference. AS-level, OID-level, community-string, source-port, and temporal features provide a more reliable behavioural profile.

Vendor OID and Targeting Patterns

NASK’s vendor-OID requests indicates strong interest in several device families and management ecosystems:

This distribution points to a mixture of network infrastructure, printers, cable/ISP equipment, and embedded devices. The presence of Brother, Kyocera, HP, Canon, Epson, and PWG-related identifiers indicates that printer and office-device discovery remains a visible part of the observed SNMP background traffic. The presence of MikroTik and Cisco suggests that network infrastructure discovery is also present.

The NASK scanner-like section is especially notable: repeated requests use the internal community string and the Brother OID 1.3.6.1.4.1.2435.2.3.9.2.11.1.1.0. Several sources repeat the same OID over extended periods, including sources active across multiple months. This pattern is more specific than generic public probing and should be treated as a candidate fingerprint for a scanner, misconfigured monitoring system, or narrowly targeted device-discovery workflow.

NASK Devices to community

CIRCL Devices to community

Conclusion

The comparative evidence shows that NASK and CIRCL observe overlapping but not identical SNMP background events. CIRCL records more total packets in the comparative window and is dominated by SNMPv1 and SNMPv2c. NASK records fewer total packets despite monitoring an address space approximately 10 times larger, but has a substantially higher SNMPv3 component. This combination suggests a different mixture of scanner behaviour, routing exposure, and possible misconfiguration-related pollution on the CIRCL dataset. NASK also exposes a notable device-family-specific pattern involving the internal community and a Brother vendor OID. These differences show why a geographically distributed network of telescopes is analytically important: a single vantage point can overrepresent local routing effects, nearby misconfigurations, or region-specific scanner populations.

For operational security, the main value of this comparison is not simply counting packets. It lies in transforming unsolicited SNMP traffic into behavioural intelligence: distinguishing generic background noise from scanner fingerprints, device-family targeting, misconfiguration leakage, and possible exploitation precursors. A harmonised and geographically distributed telescope capability would make this intelligence more robust by allowing analysts to compare observations across multiple European vantage points, separate global scanning patterns from local artefacts, and improve SOC training, alert prioritisation, and threat-hunting workflows.

At EU level, as FETTA has already demonstrated through its practical utility, this supports expanding shared network visibility across Europe and combining observations through a common research framework, while providing a stronger foundation for cybersecurity research, capacity building, and operational threat intelligence. A broader federation of European network telescopes would strengthen comparative measurement, reduce reliance on single-vantage-point interpretations, and limit dependence on non-sovereign analysis platforms.