Extending the IP internet through address reuse
ACM SIGCOMM Computer Communication Review
On the self-similar nature of Ethernet traffic (extended version)
IEEE/ACM Transactions on Networking (TON)
Why we don't know how to simulate the Internet
Proceedings of the 29th conference on Winter simulation
End-to-end internet packet dynamics
IEEE/ACM Transactions on Networking (TON)
On power-law relationships of the Internet topology
Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication
Delayed Internet routing convergence
Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
Trajectory sampling for direct traffic observation
Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
What TCP/IP protocol headers can tell us about the web
Proceedings of the 2001 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
On inferring autonomous system relationships in the internet
IEEE/ACM Transactions on Networking (TON)
Passive-aggressive resistance: OS fingerprint evasion
Linux Journal
Network topology generators: degree-based vs. structural
Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Observed structure of addresses in IP traffic
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Topology Discovery by Active Probing
SAINT-W '02 Proceedings of the 2002 Symposium on Applications and the Internet (SAINT) Workshops
The impact of address allocation and routing on the structure and implementation of routing tables
Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Measurement, modeling, and analysis of a peer-to-peer file-sharing workload
SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles
Measuring ISP topologies with rocketfuel
IEEE/ACM Transactions on Networking (TON)
Estimating loss rates with TCP
ACM SIGMETRICS Performance Evaluation Review
A first-principles approach to understanding the internet's router-level topology
Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
IPv4 address allocation and the BGP routing table evolution
ACM SIGCOMM Computer Communication Review
DIMES: let the internet measure itself
ACM SIGCOMM Computer Communication Review
Building an AS-topology model that captures route diversity
Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
AS relationships: inference and validation
ACM SIGCOMM Computer Communication Review
Communications of the ACM - ACM at sixty: a look back in time
Defeating TCP/IP stack fingerprinting
SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
Proceedings of the 2007 conference on Applications, technologies, architectures, and protocols for computer communications
Understanding passive and active service discovery
Proceedings of the 7th ACM SIGCOMM conference on Internet measurement
Usage-based dhcp lease time optimization
Proceedings of the 7th ACM SIGCOMM conference on Internet measurement
Internet optometry: assessing the broken glasses in internet reachability
Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference
Understanding block-level address usage in the visible internet
Proceedings of the ACM SIGCOMM 2010 conference
Has internet delay gotten better or worse?
Proceedings of the 5th International Conference on Future Internet Technologies
Demystifying service discovery: implementing an internet-wide scanner
IMC '10 Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
TraceNET: an internet topology data collector
IMC '10 Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
Selecting representative IP addresses for internet topology studies
IMC '10 Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
Enabling high-performance internet-wide measurements on windows
PAM'10 Proceedings of the 11th international conference on Passive and active measurement
A learning-based approach for IP geolocation
PAM'10 Proceedings of the 11th international conference on Passive and active measurement
A study of traffic, user behavior and pricing policies in a large campus network
Computer Communications
Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference
Estimating network layer subnet characteristics via statistical sampling
IFIP'12 Proceedings of the 11th international IFIP TC 6 conference on Networking - Volume Part I
Analysis of a "/0" stealth scan from a botnet
Proceedings of the 2012 ACM conference on Internet measurement conference
Towards geolocation of millions of IP addresses
Proceedings of the 2012 ACM conference on Internet measurement conference
Estimating the number of hosts corresponding to an address while preserving anonymity
NSS'12 Proceedings of the 6th international conference on Network and System Security
Towards active measurements of edge network outages
PAM'13 Proceedings of the 14th international conference on Passive and Active Measurement
Trinocular: understanding internet reliability through adaptive probing
Proceedings of the ACM SIGCOMM 2013 conference on SIGCOMM
ZMap: fast internet-wide scanning and its security applications
SEC'13 Proceedings of the 22nd USENIX conference on Security
A first look at IPv4 transfer markets
Proceedings of the ninth ACM conference on Emerging networking experiments and technologies
Estimating the number of hosts corresponding to an intrusion alert while preserving privacy
Journal of Computer and System Sciences
Estimating internet address space usage through passive measurements
ACM SIGCOMM Computer Communication Review
Demystifying internet-wide service discovery
IEEE/ACM Transactions on Networking (TON)
Hi-index | 0.00 |
Prior measurement studies of the Internet have explored traffic and topology, but have largely ignored edge hosts. While the number of Internet hosts is very large, and many are hidden behind firewalls or in private address space, there is much to be learned from examining the population of visible hosts, those with public unicast addresses that respond to messages. In this paper we introduce two new approaches to explore the visible Internet. Applying statistical population sampling, we use censuses to walk the entire Internet address space, and surveys to probe frequently a fraction of that space. We then use these tools to evaluate address usage, where we find that only 3.6% of allocated addresses are actually occupied by visible hosts, and that occupancy is unevenly distributed, with a quarter of responsive /24 address blocks (subnets) less than 5% full, and only 9% of blocks more than half full. We show about 34 million addresses are very stable and visible to our probes (about 16% of responsive addresses), and we project from this up to 60 million stable Internet-accessible computers. The remainder of allocated addresses are used intermittently, with a median occupancy of 81 minutes. Finally, we show that many firewalls are visible, measuring significant diversity in the distribution of firewalled block size. To our knowledge, we are the first to take a census of edge hosts in the visible Internet since 1982, to evaluate the accuracy of active probing for address census and survey, and to quantify these aspects of the Internet.