4 of 4 added 199 characters in body

This is what I think of when I hear "DarkNet" in a security context. In other places A DarkNet may be known as a Network Telescope.

It's a concept little like a HoneyPot except that where a HoneyPot will interact with the attackers, sending packets back and allowing TCP connections to form, a DarkNet will never let any packets back out. The purpose of a HoneyPot is to capture the exploit and/or the payload. The purpose of a DarkNet is to detect the sources of malicious traffic (by definition, all traffic entering a DarkNet is abnormal and suspect as being probably malicious).

They are often deployed purely on the internal side of a large (thousands of hosts), corporate network or a University network. If your organisation becomes infected with a worm that actively scans IP addresses looking for new hosts to infect, an internal DarkNet can often be the first trigger that alerts the Network Monitoring Team that there is a problem. Since there is so much traffic flowing around such a large network, running an IDS to analyse all that traffic becomes infeasible. No normal traffic should be sent to the DarkNet range of IP addresses so if any traffic is detected, that should trigger off an investigation of the host that sent the packets.

You can also deploy a DarkNet across external facing, publicly routable address space however, unless you are a large organisation with more address space than they know what to do with it's unlikely you can afford such luxuries. IPv6 address space is more plentiful - so much so that scanning it looking for hosts is infeasible - and so rarely deployed that you are unlikely to find any malware that scans IPv6 addresses.

Since the usefulness of a DarkNet is primarily when you have a network so large that monitoring all the traffic is infeasible, creating one in a small scale, simulated network is mostly only useful as a learning exercise. In your home or a small office network running an IPS to monitor all traffic is feasible however, there's no harm in setting aside a portion of your network address space in any sized environment to act as a DarkNet as it has a low false positive rate.

There is a great deal of information in the Team Cymru link on the goals of a DarkNet, the software used and configuration of that software and the pitfalls you might run in to. CAIDA has a paper available here explaining the concept and showing some analysis of some captured events. The Internet Motion Sensor project appears to no longer be live but there is plenty of information about it on CiteSeer.

There are also a couple of anecdotes about the types of traffic you might see on a public facing DarkNet at https://darknetproject.org/ (On that site, you are redirected to https by default but the certificate expired 18 months ago.)