Uploaded June 2026 | Updated September 2026, 3 weeks ago
MORP4: A Dynamic Network Telescope
Iliana Xygkou, Jithin K. Sojan, Dhruv Rauthan, and Feng Zhu, Georgia Institute of Technology; Thomas Holterbach, Georgia Institute of Technology and University of Strasbourg; Shane Alcock, Alcock Network Intelligence Ltd; Brian Flanagan, Ahmed Saeed, and Alberto Dainotti, Georgia Institute of Technology
A network telescope passively monitors traffic reaching Internet address space that is not assigned to any hosts but is advertised to the global routing system. This traffic is by definition unsolicited. For more than two decades, network telescopes have enabled research breakthroughs by allowing global visibility into a wide range of Internet phenomena. However, telescopes are afflicted by two main issues: progressive erosion, due to the increasing scarcity and commercial value of address space, and blacklisting. To overcome these issues, we propose MORP4, a programmable data-plane framework implementing a “dynamic” network telescope. MORP4 accurately and adaptively tracks unused space of an organization’s network with configurable time and space granularity and captures only traffic directed towards unused addresses at line rate. We provide an implementation in P4 and Python/C++, and deploy it on a Tofino switch. We show that it can detect unused IPv4 address space at the finest granularity (/32) while operating at line rate as well as providing an effective approach for operating a telescope in the IPv6 domain.
View the full NSDI '26 program at usenix.org/conference/nsdi26/technical-sessions
MORP4: A Dynamic Network Telescope
Iliana Xygkou, Jithin K. Sojan, Dhruv Rauthan, and Feng Zhu, Georgia Institute of Technology; Thomas Holterbach, Georgia Institute of Technology and University of Strasbourg; Shane Alcock, Alcock Network Intelligence Ltd; Brian Flanagan, Ahmed Saeed, and Alberto Dainotti, Georgia Institute of Technology
A network telescope passively monitors traffic reaching Internet address space that is not assigned to any hosts but is advertised to the global routing system. This traffic is by definition unsolicited. For more than two decades, network telescopes have enabled research breakthroughs by allowing global visibility into a wide range of Internet phenomena. However, telescopes are afflicted by two main issues: progressive erosion, due to the increasing scarcity and commercial value of address space, and blacklisting. To overcome these issues, we propose MORP4, a programmable data-plane framework implementing a “dynamic” network telescope. MORP4 accurately and adaptively tracks unused space of an organization’s network with configurable time and space granularity and captures only traffic directed towards unused addresses at line rate. We provide an implementation in P4 and Python/C++, and deploy it on a Tofino switch. We show that it can detect unused IPv4 address space at the finest granularity (/32) while operating at line rate as well as providing an effective approach for operating a telescope in the IPv6 domain.
View the full NSDI '26 program at usenix.org/conference/nsdi26/technical-sessions
