Abstract
Address dynamics are changes in IP address occupation as users come and go, ISPs renumber them for privacy or for routing maintenance. Address dynamics affect address reputation services, IP geolocation, network measurement, and outage detection, with implications of Internet governance, e-commerce, and science. While prior work has identified diurnal trends in address use, we show the effectiveness of Multi-Seasonal-Trend using Loess (MSTL) decomposition to identify both daily and weekly trends. We use ISP-wide dynamics to develop IAS, a new algorithm that is the first to automatically detect ISP maintenance events that move users in the address space. We show that 20% of such events result in /24 IPv4 address blocks that become unused for days or more, and correcting nearly 41k false outages per quarter. Our analysis provides a new understanding about ISP address use: while only about 2.8% of ASes (1,730) are diurnal, some diurnal ASes show more than 20% changes each day. It also shows greater fragmentation in IPv4 address use compared to IPv6.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Baltra, G., Heidemann, J.: Improving the optics of active outage detection (extended). Technical Report ISI-TR-733. USC/Information Sciences Institute (2019)
Baltra, G., Heidemann, J.: Improving coverage of internet outage detection in sparse blocks. In: Sperotto, A., Dainotti, A., Stiller, B. (eds.) PAM 2020. LNCS, vol. 12048, pp. 19–36. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-44081-7_2
Baltra, G.P.: Improving network reliability using a formal definition of the Internet core. Ph.D. Dissertation (2023)
Bandara, K., Hyndman, R.J., Bergmeir, C.: MSTL: a seasonal-trend decomposition algorithm for time series with multiple seasonal patterns (2021). https://doi.org/10.48550/ARXIV.2107.13462
Beverly, R., Durairajan, R., Plonka, D., Rohrer, J.P.: In the IP of the beholder: strategies for active IPv6 topology discovery. In: Proceedings of the ACM Internet Measurement Conference. ACM, Boston, Massachusetts, USA, pp. 308–321 (2018). https://doi.org/10.1145/3278532.3278559
CenturyLink. Event History (2019). https://status.ctl.io/history
Fail2ban (2023). https://github.com/fail2ban/fail2ban
Fan, X., Heidemann, J.: Selecting representative IP addresses for internet topology studies. In: Proceedings of the ACM Internet Measurement Conference. ACM, Melbourne, Australia, pp. 411–423 (2010). https://doi.org/10.1145/1879141.1879195
Foremski, P., Plonka, D., Berger, A.: Entropy/IP: uncovering structure in IPv6 addresses. In: Proceedings of the ACM Internet Measurement Conference. ACM, Santa Monica, CA, USA, pp. 167–181 (2016). https://doi.org/10.1145/2987443.2987445
Gasser, O., et al.: Clusters in the expanse: understanding and unbiasing IPv6 hitlists. In: Proceedings of the ACM Internet Measurement Conference, ACM, Boston, Mass., USA (2018). https://doi.org/10.1145/3278532.3278564
Gasser, O., Scheitle, Q., Gebhard, S., Carle, G.: Scanning the IPv6 internet: towards a comprehensive hitlist. In: Proceedings of the IFIP International Workshop on Traffic Monitoring and Analysis. IFIP, Louvain La Neuve, Belgium (2016). http://tma.ifip.org/2016/papers/tma2016-final51.pdf
Guillot, A., Fontugne, R., Winter, P., Merindol, P., King, A., Dainotti, A., Pelsser, C.: Chocolatine: outage detection for internet background radiation. In: 2019 Network Traffic Measurement and Analysis Conference (TMA), pp. 1–8. IEEE (2019)
Heidemann, J., Pradkin, Y., Govindan, R., Papadopoulos, C., Bartlett, G., Bannister, J.: Census and survey of the visible internet. In: Proceedings of the ACM Internet Measurement Conference. ACM, Vouliagmeni, Greece, pp. 169–182 (2008). https://doi.org/10.1145/1452520.1452542
Lumen technologies. Lumen master service agreement (2023). https://www.lumen.com/en-us/about/legal/business-customer-terms-conditions.html
MaxMind. GeoIP geolocation products (2017). http://www.maxmind.com/en/city
Meyer, D.: University of Oregon Route views (2018). http://www.routeviews.org
Moura, G.C., Ganán, C., Lone, Q., Poursaied, P., Asghari, H.. van Eeten, M.: How dynamic is the isps address space? towards internet-wide DHCP churn estimation. In: 2015 IFIP Networking Conference (IFIP Networking), pp. 1–9. IEEE (2015)
Murdock, A., Li, F., Bramsen, P., Durumeric, Z., Paxson, V.: Target Generation for Internet-wide IPv6 Scanning. In: Proceedings of the ACM Internet Measurement Conference, ACM, San Diego, CA, USA, pp. 242–253 (2017). https://doi.org/10.1145/3131365.3131405
University of Oregon. Route Views Archive Project (2020). http://archive.routeviews.org/bgpdata/2020.10/RIBS/rib.20201001.0000.bz2
Padmanabhan, R., Dhamdhere, A., Aben, E., Claffy, K.C., Spring, N.: Reasons dynamic addresses change. In: Proceedings of the ACM Internet Measurement Conference. ACM, Santa Monica, CA, USA, pp. 183–198 (2016). https://doi.org/10.1145/2987443.2987461
Padmanabhan, R., Rula, J.P., Richter, P., Strowes, S.D., Dainotti, A.: DynamIPs: analyzing address assignment practices in IPv4 and IPv6. In: Proceedings of the ACM Conference on Emerging Networking Experiments and Technologies, ACM, Barcelona, Spain, pp. 55–70 (2020). https://doi.org/10.1145/3386367.3431314
Padmanabhan, R., Schulman, A., Dainotti, A., Levin, D., Spring, N.: How to find correlated internet failures. In: Choffnes, D., Barcellos, M. (eds.) PAM 2019. LNCS, vol. 11419, pp. 210–227. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-15986-3_14
Plonka, D., Berger, A.: Temporal and spatial classification of active IPv6 addresses. In: Proceedings of the ACM Internet Measurement Conference, Tokyo, Japan, pp. 509–522. ACM (2015). https://doi.org/10.1145/2815675.2815678
The Spamhaus project (2023). https://www.spamhaus.org
Quan, L., Heidemann, J., Pradkin, Y.: Trinocular: understanding internet reliability through adaptive probing. In: Proceedings of the ACM SIGCOMM Conference, Hong Kong, China, pp. 255–266. ACM (2013). https://doi.org/10.1145/2486001.2486017
Quan, L., Heidemann, J., Pradkin, Y.: When the internet sleeps: correlating diurnal networks with external factors. In Proceedings of the ACM Internet Measurement Conference, Vancouver, BC, Canada, pp. 87–100. ACM (2014). https://doi.org/10.1145/2663716.2663721
Richter, P., Padmanabhan, R., Spring, N., Berger, A., Clark, D.: Advancing the art of internet edge outage detection. In: Proceedings of the ACM Internet Measurement Conference, Boston, Massachusetts, USA, pp. 350–363. ACM (2018). https://doi.org/10.1145/3278532.3278563
Richter, P., Smaragdakis, G., Plonka, D., Berger, A.: Beyond counting: new perspectives on the active IPv4 address space. In: Proceedings of the 2016 Internet Measurement Conference, pp. 135–149 (2016)
RIPE Atlas. IPv4 B-root ping (2023). https://atlas.ripe.net/measurements/1010/
RIPE Ncc Staff. RIPE Atlas: a global internet measurement network. Internet Protocol J. 18(3), 2–26 (2015). http://ipj.dreamhosters.com/wp-content/uploads/2015/10/ipj18.3.pdf
Song, X., Baltra, G., Heidemann, J.: Inferring changes in daily human activity from internet response. In: Proceedings of the ACM Internet Measurement Conference, ACM, Montreal, QC, Canada (2023). https://doi.org/10.1145/3618257.3624796
USC/ISI ANT project (2017). https://ant.isi.edu/datasets/all.html. (Updated quarterly)
Xie, Y., Yu, F., Achan, K., Gillum, E., Goldszmidt, M., Wobber, T.: How dynamic are IP Addresses?. In: Proceedings of the ACM SIGCOMM Conference, Kyoto, Japan, pp. 301–312. ACM (2007). https://doi.org/10.1145/1282380.1282415
Zirngibl, J., Steger, L., Sattler, P., Gasser, O., Carle, G.: Rusty clusters?: dusting an IPv6 research foundation. In: Proceedings of the 22nd ACM Internet Measurement Conference, France, pp. 395–409. ACM (2022). https://doi.org/10.1145/3517745.3561440
Acknowledgments
The work is supported in part by the National Science Foundation, CISE Directorate, award CNS-2007106 and NSF-2028279. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendices
A Research Ethics
Our work poses no ethical concerns for several reasons.
First, we collect no additional data, but instead reanalyze data from existing sources. Our work therefore poses no additional risk in data collection.
Our analysis poses no risk to individuals because our subject is network topology and connectivity. There is a slight risk to individuals in that we examine responsiveness of individual IP addresses. With external information, IP addresses can sometimes be traced to individuals, particularly when combined with external data sources like DHCP logs. We avoid this risk in three ways. First, we do not have DHCP logs for any networks (and in fact, most are unavailable outside of specific ISPs). Second, we commit, as research policy, to not combine IP addresses with external data sources that might de-anonymize them to individuals. Finally, except for analysis of specific cases as part of validation, all of our analysis is done in bulk over the whole dataset.
We do observe data about organizations such as ISPs, and about the geolocation of blocks of IP addresses. Because we do not map IP addresses to individuals, this analysis poses no individual privacy risk.
Finally, we suggest that while our work poses minimal privacy risks to individuals, to also provides substantial benefit to the community and to individuals. For reasons given in the introduction it is important to improve network reliability and understand how networks fail. Our work contributes to that goal.
Our work was reviewed by the Institutional Review Board at our university and because it poses no risk to individual privacy, it was identified as non-human subjects research (USC IRB IIR00001648).
B A Sample Block with Diurnal Behavior
The block in Fig. 9 from AS9829 shows how one /24 occupancy varies over the course of a day. Green dots show active addresses, and gray non-response. This address block is 50% full every day at its peak, but empty every night. This trend can be seen in the count of active address (the top graph). It causes daily outage events in Trinocular, as shown in the middle graph, showing up most of the day but down every night. Blocks that look like this are common in this AS, and they show the need for our IDD algorithm (Sect. 3.3).
C Does Unmonitored Space Harm IAS?
Measurement systems do not track the complete address space, as some segments are discarded due to low response rate, as well as addresses that historically have not responded [2]. Users reassigned to unmonitored space implies that IAS may erroneously infer outages due to drops in the total active address count, IAS false negatives. To evaluate if unmonitored space interferes with IAS, we count the number of times known VPs move to and from our underlying measurement system’s unmonitored address space. We expect most of VPs to move within monitored addresses, as unmonitored space has been historically unresponsive implying low usage.
Trinocular strives to probe as much as it can (the active addresses), Trinocular excludes addresses for two reasons, inactive addresses used to reply to pings but have not in two years, and non-trackable blocks have less than three responsive addresses.
As with Sect. 4.2, we use RIPE Atlas VPs as ground truth, since they track their current IP addresses. Table 4 counts how many addresses Atlas VPs have in each of the three Trinocular categories (active, inactive, non-trackable).
As expected, the majority of reassignments (51%) occur within monitored addresses (the top, left, green cell). In addition, most addresses (84%) stay in the same category (the diagonal).
A few addresses (7% in the yellow, left column) become active as they move in to measurable space, and about an equal number move out (the 7% in the red, top row). Finally, a surprisingly large 35% are never tracked (the gray region). Since the IAS goal is identify steady or changing addresses, never tracked blocks do not matter. The number that becomes and cease to be active is small (7% each) and about equal in size, so they should not skew IAS. We therefore conclude IAS is not impeded by incomplete measurement.
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Baltra, G., Song, X., Heidemann, J. (2024). Ebb and Flow: Implications of ISP Address Dynamics. In: Richter, P., Bajpai, V., Carisimo, E. (eds) Passive and Active Measurement. PAM 2024. Lecture Notes in Computer Science, vol 14538. Springer, Cham. https://doi.org/10.1007/978-3-031-56252-5_7
Download citation
DOI: https://doi.org/10.1007/978-3-031-56252-5_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-56251-8
Online ISBN: 978-3-031-56252-5
eBook Packages: Computer ScienceComputer Science (R0)