Abstract

Full allocation of IPv4 addresses has prompted interest in measuring address liveness, first with active probing, and recently with the addition of passive observation. While prior work has investigated how to increase coverage by combining multiple sources, this paper explores what factors affect a passive observer’s view. All passive monitors are sparse, seeing only a part of the Internet. We seek to understand how different types of sparsity impact observation quality: the interests of external hosts and the hosts within the observed network, the temporal limitations on the observation duration, and coverage challenges to observe all traffic for a given target or a given vantage point. We study sparsity through inverted analysis—a new approach where we use passive observations at three end networks to infer what of these networks would be seen by virtual monitors, located at all traffic destinations. We show that visibility provided by monitors is heavy-tailed—interest sparsity means popular monitors see a great deal, while 99% see very little. We find that traffic is mostly bipartite, with greater visibility between client-networks and server-networks, than within each group. Finally, we find that popular monitors are robust to temporal and coverage sparsity, but these sparsities greatly reduce power of monitors with initially low visibility.

Date

January 1, 1970

Authors

Jelena Mirkovic, Genevieve Bartlett, John Heidemann, Hao Shi, Xiyue Deng

Journal

Technical Report ISI-TR-2016–710