Knock Knock: the Website That Lets You Hear the Internet’s Background Noise

Knock Knock makes something invisible suddenly obvious: the moment any computer is exposed to the open internet, a steady stream of automated visitors begins probing it, testing its doors, and moving on. The site turns that ceaseless, unseen traffic into something you can watch and even hear, and the effect is quietly unsettling in the best way.

In brief

• It reveals the constant automated scanning that hits any public internet address.
• Each probe becomes a visible, audible event, so you can watch and hear the traffic arrive.
• This traffic is often called internet background noise, and it never fully stops.
• The site makes an abstract fact of network life into a concrete, sensory experience.

The doors nobody sees being tried

Every device connected directly to the public internet is, in effect, a building with a great many doors. Most of the time the owner only thinks about the front entrance. But out in the wider network, automated programs are constantly walking down the street trying every handle on every building they can find, not because they know anything about you, but because they are methodically checking everyone.

Knock Knock dramatises exactly that. When a probe arrives, the site marks it, so you see the knocks land one after another, from all over. There is no single culprit and no particular target. It is simply the ambient behaviour of a network where scanning is cheap and endless. The steady rhythm of arrivals is the point.

Turning data into a sound you can feel

Plenty of security tools log this kind of traffic, but a log is easy to ignore. By giving each probe a visual and audible presence, the site changes how the information registers. You do not read a number that says thousands of scans per hour. You hear the knocking, and you feel how relentless it is. Sonification, the practice of turning data into sound, is good at exactly this: making a scale that numbers flatten suddenly vivid.

The result is oddly meditative and slightly eerie at once. The internet you use feels calm and orderly. The internet underneath, the one machines talk on, turns out to be a busy, indifferent place where automated visitors never sleep. Knock Knock lets you sit with that contrast for a while.

What the noise actually is

This background traffic has a name among network engineers. It is often called internet background noise, and it is a well-studied phenomenon with its own reference entry. It is made up of automated scans, misconfigured devices, leftover traffic from old infections, and research crawlers, all endlessly sweeping the address space. Point a fresh, unprotected machine at the open internet and the first knocks typically arrive within seconds, not hours.

Most of it is not personal and not immediately dangerous. It is closer to weather than to an attack: a constant condition of the environment rather than a targeted event. But it is also a useful reminder that anything you expose to the network is discovered almost instantly, whether or not you told anyone it was there.

A gentle education in how the network really works

What makes Knock Knock more than a novelty is that it teaches without lecturing. Anyone who spends a few minutes with it comes away with a durable intuition: the internet is not a quiet place you occasionally visit, but a noisy one that is always probing back. That single realisation underpins a lot of good security hygiene, from closing unused doors to not assuming obscurity equals safety.

As the r/InternetIsBeautiful thread about it shows, the common reaction is a mix of fascination and mild alarm, which is the right response. The traffic was always there. The site simply gives you a window and a speaker, and lets the network speak for itself.

The beauty of the overlooked

There is a particular pleasure in a site that reveals a hidden layer of something you use every day. Knock Knock does not add anything to the internet. It just exposes a part of it that was already humming along beneath notice, and in doing so it makes the ordinary strange again. That is a very boring-web thing to do, in the best sense.

Readers who enjoy watching small, unglamorous systems do their quiet work will find kindred spirits across the network, including the deadpan procedural charm of The Bureau of Tiny Approvals, which finds its own comedy in the machinery running just out of sight.

What the scanners are actually looking for

The knocking is not aimless, even if it is impersonal. Most of it is automated software methodically checking every address it can reach for signs of something useful: a login page, a database left open, a device still running old software with a known weakness. The programs are not curious about any particular target. They are running down a checklist against the entire internet, and your address simply happens to be on the list along with everyone else's.

Some of the traffic is more benign. Legitimate research projects scan the internet to measure its health and map how services are configured. Search and indexing systems probe constantly. Old, forgotten devices send out confused traffic long after anyone stopped maintaining them. And some of it is the digital equivalent of litter, leftover signals from infections and misconfigurations bouncing around with no one at the wheel. Knock Knock does not sort these motives for you. It simply shows that the knocking, whatever its source, never stops.

The important realisation is that discovery is automatic and immediate. There is a persistent myth that a small, unremarkable machine is safe simply because no one knows it is there. The scanners put the lie to that. They are not waiting to be told about anything. They find everything, constantly, on principle, and they do it within seconds of a device appearing on the network.

A long tradition of watching the watchers

Security researchers have studied this background traffic for a long time, sometimes by setting up machines whose only job is to be probed and to record what comes at them. By deliberately exposing a system and logging every knock, they build a picture of what the automated internet is currently interested in, which weaknesses are being hunted this week, and how quickly a fresh target gets found. It is a way of listening to the network's ambient chatter and learning from it.

Knock Knock brings a slice of that research sensibility to anyone with a browser. You do not need to run infrastructure or read logs to grasp the core finding. The site hands you the same basic experience the researchers have, the sense of a machine sitting quietly while an indifferent world tries its handles, and it does so in a form that takes seconds to understand. It democratises a piece of knowledge that used to require a lab.

Why making it audible changes everything

A column of log entries scrolling past is easy to dismiss as noise in the other sense of the word. Numbers on a screen do not convey scale in a way the body feels. Sound does. When each probe becomes an audible event, the sheer frequency of arrivals stops being an abstraction and becomes a rhythm you can hear speeding up and layering over itself. The internet's background traffic goes from a statistic to a presence in the room.

This is the real cleverness of the project. It is not adding information so much as changing the channel through which the information reaches you. The same facts, delivered as sound, provoke a different and more accurate reaction: not boredom but a slightly widened set of eyes. Sonification works because it recruits senses that numbers leave cold, and Knock Knock uses it to make an invisible truth impossible to ignore.

What ordinary people can take from it

You do not need to be a security professional to benefit from what Knock Knock reveals. The everyday lesson is simple: anything you connect to the open internet is found and tested almost immediately, so the sensible defaults are to close doors you are not using, keep software current, and never rely on being unnoticed as a form of protection. Obscurity is not a lock. The scanners proved that before you finished reading this sentence.

There is also a calmer takeaway. Most of this traffic is weather, not warfare, a constant background condition rather than a personal threat. Understanding that difference helps replace vague dread with useful caution. The point of seeing the knocking is not to be frightened of the internet but to hold a truer picture of it, one where the quiet you experience on the surface coexists with a great deal of automated activity underneath.

The sound of a scale we usually ignore

Part of what makes Knock Knock linger in the mind is that it gives a body to a number most people never really feel. It is one thing to be told that a public machine receives thousands of automated contacts a day. It is another to sit and listen as the knocks arrive, overlapping and relentless, until the individual events blur into a texture. The statistic becomes a soundscape, and the soundscape makes the scale undeniable.

This is a broader gift of turning data into sensation. Human intuition is poor at large numbers and constant background processes, the very things that define how the internet actually operates. We notice events, not conditions. By rendering a continuous condition as sound, the site slips past that blind spot and lets you perceive something your instincts would otherwise round down to nothing. It makes the ambient audible, and the audible is much harder to dismiss.

There is a quiet beauty in that, separate from any lesson about security. The internet most people experience is a curated surface of pages and apps. Underneath runs an enormous, ceaseless machine conversation that has nothing to do with any particular person and never pauses. Knock Knock opens a small window onto that hidden layer and lets you listen to it hum. It is eerie, and it is also, in its strange way, a kind of music the network was always playing.

FAQ

Is the traffic Knock Knock shows dangerous?

Mostly it is impersonal background scanning rather than a targeted attack. It is a normal condition of the open internet, though it is a good reminder to secure anything you expose to the network.

Why do the knocks start so quickly?

Because automated scanners continuously sweep the entire internet address space. A newly exposed machine is typically found within seconds, not because anyone was told about it, but because everything gets checked.

What is internet background noise?

It is the constant, largely automated traffic that reaches any public address: scans, misconfigured devices, and crawlers. It is a studied phenomenon with its own reference entry.

Do I need to install anything?

No. Knock Knock runs in the browser and lets you watch and hear the probing without any setup.