Temporal and Spatial Classification of Active IPv6 Addresses

Abstract

There is striking volume of World-Wide Web activity on IPv6 today. In early 2015, one large Content Distribution Network handles 50 billion IPv6 requests per day from hundreds of millions of IPv6 client addresses; billions of unique client addresses are observed per month. Address counts, however, obscure the number of hosts with IPv6 connectivity to the global Internet. There are numerous address assignment and subnetting options in use; privacy addresses and dynamic subnet pools significantly inflate the number of active IPv6 addresses. As the IPv6 address space is vast, it is infeasible to comprehensively probe every possible unicast IPv6 address. Thus, to survey the characteristics of IPv6 addressing, we perform a year-long passive measurement study, analyzing the IPv6 addresses gleaned from activity logs for all clients accessing a global CDN.The goal of our work is to develop flexible classification and measurement methods for IPv6, motivated by the fact that its addresses are not merely more numerous; they are different in kind. We introduce the notion of classifying addresses and prefixes in two ways: (1) temporally, according to their instances of activity to discern which addresses can be considered stable; (2) spatially, according to the density or sparsity of aggregates in which active addresses reside. We present measurement and classification results numerically and visually that: provide details on IPv6 address use and structure in global operation across the past year; establish the efficacy of our classification methods; and demonstrate that such classification can clarify dimensions of the Internet that otherwise appear quite blurred by current IPv6 addressing practices.

Something from Nothing (There): Collecting Global IPv6 Datasets from DNS

“…We devised another heuristic based on the assumption that if a zone is dynamically-generated, then all records in the zone should be present. Following prior work by Plonka et al and Foremski et al [15,8], we determined that certain records are unlikely to exist in one zone all together, specifically, all possible terminal records of a base that utilize only one character repeatedly. .arpa.…”

“…Indeed, most current research efforts in the networking community are concerned with evaluating large datasets to provide descriptive information on utilized IPv6 addresses [10]. Plonka and Berger provide a first assessment of active IPv6 addresses in their 2015 study using a large CDN's access statistics as dataset [15]. Subsequently, in their 2016 work Foremski et al propose a technique to generate possibly utilized IPv6 addresses from initial seed datasets for later active probing [8].…”

“…However, unfortunately for the common researcher, these studies have-so far-been dominated by the analysis of large, restricted, and proprietary datasets. For instance, the wellknown content delivery network (CDN) dataset used for most contemporary IPv6 analyses [15,8], Internet exchange point (IXP) datasets, which were used regularly by some other research groups [3,9], or, slightly less restrictive, the Farsight DNS recursor dataset [21]. Although public datasets do exist, they are traceroute-based datasets from various sources, including the RIPE Atlas project [17], which are limited due to their nature: they are biased towards addresses of networking equipment, and, in turn, bear their own set of problems for meaningful analyses.…”

Empirical Study of Router IPv6 Interface Address Distributions

“…13 By clustering the addresses of Web clients that access the CDN, inference can be made on the ways in which providers are allocating addresses and subnets to clients. Our work is largely complementary to this prior study: rather than opportunistically relying on passive traffic (such as clients that access the CDN) our active probing helps eliminate possible sample bias.…”

Diurnal and Weekly Cycles in IPv6 Traffic

“…IPv6 traffic patterns therefore affect considerations around load balancing, hardware provisioning, network security, and peering; see also [3,4,5]. Thus, knowledge of traffic patterns in networks and regions assists network planning.…”