Newsletter

Research & field notes,
when we have something to say

We publish when there's something worth publishing - operational findings, new signal launches, Internet anomaly investigations, and organizational updates. No calendar-driven filler.

What to expect

Signal-driven. No noise.

Every issue is grounded in actual data from our feeds. We share what we observe, what it might mean, and what we're doing about it - then get out of the way.

Subscribe free on Substack →
Free to read, always
Published quarterly (or whenever the data demands it)
No advertising, no sponsored content
Hosted on Substack - unsubscribe any time
Latest Issue
Most Recent Q1 2025

Dataplane.org 2025 Year in Review

New NTP signal feeds added to the suite. An analysis of evolving SSH password credential patterns observed across sensors - length distributions, common strings, and what's changed year-over-year. Plus: observations of unsolicited DNS traffic reaching sensors from unexpected source ranges, and what that DNS "radiation" suggests about the broader scanning landscape.

NTP SSH DNS Year in Review
Read issue →
Full Archive
Q1 2025

Dataplane.org 2025 Year in Review

New NTP signal feeds added to the suite. Analysis of evolving SSH password credential patterns - length distributions, common strings, and …

NTP SSH DNS Year in Review
Read issue →
March 2024

Destination-Adjacent Source Address Spoofing

An investigation into a pattern of source-spoofed DNS queries - packets appearing to originate from IPs topologically adjacent to the …

DNS Investigation
Read issue →
March 2024

Dataplane.org 2024 Q1 Newsletter

Organizational updates including financial and legal status, an overview of ongoing research collaborations, notes on sensor network growth, …

Operations Research
Read issue →
2024

Aging Relying Party Clients

A look at RPKI relying party client software versions observed by our measurement infrastructure - how current they are, which …

RPKI BGP
Read issue →
October 2023

Dataplane.org 2023 Q3 Newsletter

Two new signal feeds announced: dnstypename and sshpwauthpairs. The DNS type-name feed provides a daily view of IN-class query types from …

DNS SSH New Feeds
Read issue →
January 2024

2023 Recap: Apache Struts NETINT & the Year in SSH Passwords

A year-end look at notable signal activity in 2023. Analysis of scanning observed following the Apache Struts vulnerability …

SSH Vulnerability Year in Review
Read issue →
January 2022

RPKI Measurement & a SSH Mystery

New findings from ongoing RPKI relying-party measurement work. A mysterious and unexplained drop in SSH authentication traffic across …

RPKI SSH Investigation
Read issue →
March 2022

API Preview & Signal Statistics

A preview of the signal search API at dev.dataplane.org (search by IP, prefix, or ASN across all feeds) and the launch of the Signal …

New Features SSH Statistics
Read issue →
May 2022

Aging Relying Party Clients

An examination of RPKI relying party client software versions observed fetching data. Which implementations are keeping up with updates, …

RPKI BGP
Read issue →
Early 2023

Dataplane.org 2022 Year in Review

A look back at 2022: notable traffic spikes, sensor network expansion, DNS and SSH signal trends, and organizational milestones. Covers the …

DNS SSH Year in Review
Read issue →
All Issues on Substack →
About This Newsletter

Written by operators, for people who care about the Internet

The Dataplane.org newsletter isn't a marketing channel - it's a direct line from our sensor infrastructure to the people who use the data. When we see something interesting in the feeds, we write about it. When we launch something new, we explain why. When the organization has news, we share it plainly.

Issues are published on Substack, which handles delivery, archiving, and subscriptions. There's no paywall - everything is free to read, and we don't share or sell subscriber information.

No fixed schedule

We publish when there's something worth saying. Some years that's monthly, others it's quarterly. We won't pad the archive with filler.

No advertising, ever

Dataplane.org products are ad-free. The newsletter follows the same rule - no sponsors, no promoted content, no affiliate links.

Data-first writing

Every issue is grounded in real observations from our feeds. We lead with data, explain what we see, and draw careful conclusions.

Free, always

All issues are free to read, forever. No paywall, no premium tier. Subscribe on Substack and unsubscribe any time with one click.