ACM Published Papers
Internet background radiation revisited 2010
Internet background radiation revisited
Wustrow, E., Karir, M., Bailey, M., Jahanian, F., Huston, G;
Published in: IMC'10 Proceedings of the 10th annual conference on Internet measurement
Page(s) 62 - 74
Publication Year: 2010
ISBN: 978-1-4503-0483-2
Digital Object Identifier: 10.1145/1879141.1879149 The monitoring of packets destined for routeable, yet unused, Internet addresses has proved to be a useful technique for measuring a variety of specific Internet phenomenon (e.g., worms, DDoS). In 2004, Pang et al. stepped beyond these targeted uses and provided one of the first generic characterizations of this non-productive traffic, demonstrating both its significant size and diversity. However, the six years that followed this study have seen tremendous changes in both the types of malicious activity on the Internet and the quantity and quality of unused address space. In this paper, we revisit the state of Internet "background radiation" through the lens of two unique data-sets: a five-year collection from a single unused 8 network block, and week-long collections from three recently allocated 8 network blocks. Through the longitudinal study of the long-lived block, comparisons between blocks, and extensive case studies of traffic in these blocks, we characterize the current state of background radiation specifically highlighting those features that remain invariant from previous measurements and those which exhibit significant differences. Of particular interest in this work is the exploration of address space pollution, in which significant non uniform behavior is observed. However, unlike previous observations of differences between unused blocks, we show that increasingly these differences are the result of environmental factors (e.g., misconfiguration, location), rather than algorithmic factors. Where feasible, we offer suggestions for clean up of these polluted blocks and identify those blocks whose allocations should be withheld.
IPv4 Address Allocation and the BGP Routing Table Evolution 2005
IPv4 Address Allocation and the BGP Routing Table Evolution
Meng, X; Xu, Z; Zhang B;, Huston, G; Lu, S; Zhang, L;
Published in: ACM SIGCOMM Computer Communication Review
Volume: 35, no, 1
Page(s): 71-80
Publication Year: 2005
ISSN: ISSN:0146-4833
Digital Object Identifier: 10.1145/1052812.1052827
Abstract:
- The IP address consumption and the global routing table size are two of the vital parameters of the Internet growth. In this paper we quantitatively characterize the IPv4 address allocations made over the past six years and the global BGP routing table size changes during the same period of time. About 63,000 address blocks have been allocated since the beginning of the Internet, of which about 18,000 address blocks were allocated during our study period, from November 1997 to August 2004. Among these 18,000 allocations, 90% of them started being announced into the BGP routing table within 75 days after the allocation, while 8% of them has not been used up to now. Among all the address blocks that have ever been used, 45% of them were split into fragments smaller than the original allocated blocks; without these fragementations, the current BGP table would have been about half of its current size. Furthermore, we found that the evolution of BGP routing table consists of both the appearance of new prefixes and the disappearance of old prefixes. While the change of the BGP routing table size only reflects the combined results of the two processes, the dynamics of either process is much higher than that of the BGP table size. Finally, we classify routing prefixes into covering and covered ones, and examine their evolution separately. For the covered prefixes, which account for almost half of the BGP table size, we infer their practical motives such as multihoming, load balancing, and traffic engineering, etc., via a classification method.