A new paper by Mark Allman, for an upcoming conference.

Incessant scanning of hosts by attackers looking for vulnerable servers has become a fact of Internet life.

In this paper we present an initial study of the scanning activity observed at one site over the past 12.5 years.

We study the onset of scanning in the late 1990s and its evolution in terms of characteristics such as the number of scanners, targets and probing patterns.

While our study is preliminary in many ways, it provides the first longitudinal examination of a now ubiquitous Internet phenomenon.