Understanding Different Perspectives

Abstract

Reactive telescopes reveal scanning behavior that passive telescopes cannot observe, but prior deployments have focused exclusively on TCP. We present RT-UDP, the first transport-layer reactive telescope for UDP, which returns empty UDP packets across all ports while applying rate limits to limit its contribution to reflection attacks. We deploy RT-UDP alongside passive telescopes and TCP responders at four university networks in three countries and compare their observations over 30 days. Activating RT-UDP increases observed UDP source addresses by 13.0-43.8% and flows by 11.7-99.6%, although the additional traffic is concentrated among a small subset of sources. It also shifts the application-layer landscape: approximately half of the traffic targets the top 10 destination ports, and services rarely visible in passive telescopes become prominent. Despite carrying no application-layer data, an empty UDP response alters sender behavior: retransmissions increase by 87-602%, different-payload follow-ups by more than 200%, and TCP fallback by over an order of magnitude. Payload analysis further reveals protocol switching and multi-stage probing triggered by interaction. These findings demonstrate that minimal transport-layer responses expose UDP scanning strategies and service ecosystems that remain largely invisible to passive measurement.