Understanding block-level address usage in the visible internet

Abstract

Although the Internet is widely used today, we have little information about the edge of the network. Decentralized management, firewalls, and sensitivity to probing prevent easy answers and make measurement difficult. Building on frequent ICMP probing of 1% of the Internet address space, we develop clustering and analysis methods to estimate how Internet addresses are used. We show that adjacent addresses often have similar characteristics and are used for similar purposes (61% of addresses we probe are consistent blocks of 64 neighbours or more). We then apply this block-level clustering to provide data to explore several open questions in how networks are managed. First, we provide information about how effectively network address blocks appear to be used, finding that a significant number of blocks are only lightly used (most addresses in about one-fifth of 24 blocks are in use less than 10% of the time), an important issue as the IPv4 address space nears full allocation. Second, we provide new measurements about dynamically managed address space, showing nearly 40% of 24 blocks appear to be dynamically allocated, and dynamic addressing is most widely used in countries more recent to the Internet (more than 80% in China, while less than 30% in the U.S.). Third, we distinguish blocks with low-bitrate last-hops and show that such blocks are often underutilized.

Understanding block-level address usage in the visible internet

“…More troubling are addresses used by multiple computers at different times-such addresses actually represent multiple hosts. The purpose of dynamically allocated addresses is exactly to share one address with multiple computers, and we know dynamic assignment is common (see § [4]). If those hosts are used for different purposes (servers sometimes, and clients others), usage inference will be difficult and unreliable.…”

“…We selected these categories to split the majority of the (A(b), V (b), U * (b)) space, informed by evaluations of dozens of blocks (573K addresses in total) backed by manual probing of hosts and hostnames (details, see [4]). …”

“…For example, dial and dsl suggest edge link technologies, and dynamic or pool suggest dynamic address assignment. (Full details [4] are omitted here due to space.) Among the various usage suggested by hostnames, underutilized blocks are correlated with pool (68%), ppp (56%) and dial (54%) hostname categories.…”

“…Hostnames are often assigned in patterns that suggest common administration and access method. For example, hostnames in 4 …”

“…We next compare surveys taken two years apart: IT17ws and a 6-day subset of IT31ws (data for IT31ws is in [4] due to space constraints). There are two main differences: first, many blocks shift from sometimes-stable to always-stable, where IT31ws has 2,459 always-stable /24 blocks compared to only 2,001 before (33% vs. 23%).…”