Methodology

Blackhole monitoring
Collect traffic to a globally announced, unused /8 network
Provided by a research partner
Roughly 1/256 of entire Internet address space
Collects backscatter from spoofed sources

Network monitoring
Monitor several Tier 1, Tier 2 networks
Sees both spoofed and not spoofed attacks