Background Noise Screensaver
The Background Noise screensaver shows thirty days of daily totals from volunteered firewall logs, read live and key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the Background Noise screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
Thirty days of daily totals from volunteered firewall logs, read live and key-less. Packet counts swing by an order of magnitude because one campaign can dominate the dataset, so the source count is the steadier read.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
Where the Internet Storm Center data comes from
The SANS Internet Storm Center is part of the SANS Technology Institute, and DShield is its distributed intrusion detection system. Volunteers around the world submit logs from their firewalls and intrusion-detection systems, and software tools strip identifying information before the logs are sent. The centre pools the reports of unwanted traffic to see what the wider internet is being probed for, and volunteer incident handlers analyse them for emerging attack trends.
The daily summary series reports three totals for each day: the number of reports (packets) submitted, the number of distinct source addresses they came from, and the number of distinct target addresses they were sent to. Sources are the steadier measure: a single scanner can generate millions of packets, but it is still one source.
The data are a sample, not a census. Contributors are volunteers whose networks are not representative of the whole internet, and the number of active sensors can change over time. A spike may simply mean a large campaign hit a few sensors hard, or that many sensors joined, so it should not be read as an attack on any particular organisation or as a sign of a wider crisis.
A worked example
Thirty days of daily totals from volunteered firewall logs, read live and key-less. Packet counts swing by an order of magnitude because one campaign can dominate the dataset, so the source count is the steadier read.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- What is DShield?
- The distributed intrusion detection system behind the SANS Internet Storm Center. Volunteers' firewalls and sensors submit logs of unwanted traffic, which are analysed for emerging attack trends.
- Why would packet counts spike?
- A single large scanning campaign or a change in the number of reporting sensors can swing totals far more than the real amount of scanning.
- Does this show attacks on me?
- No. It describes traffic seen by volunteer sensors in aggregate, not what happened on any particular network.