Cai, Xue
Ph.D. Student
Department of Computer Science
University of Southern CaliforniaE-mail: xuecai at usc.edu
Classify Internet Address Blocks
Introduction
Previous Internet topology studies focus on router or AS connectivity. We instead examine how Internet edge hosts are used in the IPv4 address space. In ongoing work we are exploring methodologies to actively probe all IPv4 addresses with ICMP echo requests (pings) [Heidemann08a]. Here we examine how to classify Internet address blocks based on their ping responses.
We introduced a 4-step methodology to identify Internet address blocks and classify them into 5 categories: always-stable, sometimes-stable, intermittent, underutilized and unclassifiable by ping responses. Our results show that the minimum of the typical block size is /24 and suggest significant IP dynamics and IPv4 address underutilization.
Methodology
The 4-step methodology to classify Internet address blocks
An example of classifying Internet address blocks
An example of classifying address blocks within one /24 block is shown bellow. There are 7 blocks indentified. 1 /26, 1 /27, 1 /28, 1 /32are classified as stable blocks, while 1 /26, 2 /27 blocks are classified as intermittent blocks.
Training: how to relate pings to usage? We define 5 ping-observable categories based on hostname-inferred usage categories
We classified hostnames into usage categories using ISC data [ISC07]. We relate usage to ping-observation by IP address. This process maps ping-observable categories to hostname-inferred usage categories.
The hostname-inferred usage categories
static, dynamic, dhcp, pool-pond, ppp, dial, dsl, cable,wireless, ded, biz, res, client, server, rtr-gw [Sullivan06].
The ping-observable categories
- Always-stable: A > 0.95, V < 0.0016 (Nu=1)
- Sometimes-stable: MedianUp >= 6hours
- Intermittent: MedianUp < 6hours
- Underutilized: A < 0.1
- Unclassifiable: < 20% responses
Results: Internet address blocks classified into 5 ping-observable categories
Ping-observable block classification example
Density (A, V) plot at left show 12,198 indentified /24 blocks. Eight examples around edge show (A, V) of each address in /24 blocks. The density A/V plot shows 4 (without unclassifiable) ping-observable categories:
- Always-stable: A > 0.95, V < 0.0016 (Nu=1)
- Sometimes-stable: MedianUp >= 6hours
- Intermittent: MedianUp < 6hours
- Underutilized: A < 0.1
Classification results
What are the sizes of blocks that show consistent usage?
Method: identify blocks by ping-observations.
Answer: many /24 blocks are used consistently (58.5% of all responded /24s), and most addresses are in a consistent /24 block. But, there are also many smaller consistent block sizes.
Validation: we see similar results in different survey [ITsurvey17w] and [ITsurvey16w]. The correlation coefficient is 0.9998.
Are there wasted blocks?
Method: look for underutilized blocks.
Answer: There are many underutilized blocks (22.7% of identified&classifiable /24s). Warning: firewalls may lead to non-response, thus fail the results, see [Heidemann08].
Validation: we see similar results in different survey [ITsurvey17w] and [ITsurvey16w]. There are 22.5% of identified&classifiable /24s in [ITsurvey16w] are underutilized.
How many dynamic blocks? [Xie07]
Method: look for intermittent blocks.
Answer: There are many intermittent blocks (30.4% of identified&classifiable /24s).
Validation: to validate the ratio, we see similar results in different survey [ITsurvey17w] and [ITsurvey16w]. There are 28.3% of identified&classifiable /24s in [ITsurvey16w] are intermittent. To validate the correlation between intermittent and dynamic, we classified 338 hostname-inferred dynamic /24 blocks into ping-observable categories. 48.2% of them are intermittent, 36.4% are underutilized. We see similar results in different surveys, the correlation coefficient is 0.9789.
