Beyond Counting: New Perspectives on the Active IPv4 Address Space @IETF 96 Berlin (maprg) July 2016 Philipp Richter Georgios Smaragdakis David Plonka Arthur Berger TU Berlin MIT Akamai Akamai/MIT work under submission comments highly appreciated! preprint: http://arxiv.org/abs/1606.00360
IPv4 Address Space Exhaustion • IPv4 has been around for ~35 years • Theoretically routable IP addresses: 3.7B, ~2.8B routed • IANA exhausted its address pool in 2011 • Today: Less than 2% of the IPv4 address space “free” 250 total address space limit (256 /8 equivalents) RIR ● APNIC LACNIC ● routable address space limit (220.7 /8 equivalents) ● 200 ● Framework exhausted exhausted ● Initiation Last RIR ● /8 equivalents IPv4 RIPE ARIN ● First RIR (RIPE) (AFRINIC) 150 ● Standard exhausted exhausted founded ● founded ● ● ● ● 100 ● ● 2014 1981 1992 2005 2011 2012 2015 ● ● 50 Early Registration Needs-Based Provision Depletion & Exhaustion allocated address blocks ● routed address blocks 0 Nov 1997 Jan 2002 Jan 2006 Jan 2010 Jan 2014 Figures: P. Richter, M. Allman, R. Bush, V. Paxson: A Primer on IPv4 Scarcity, ACM CCR 45(2), 2015. Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 1
Operators' Community Efforts Efforts in the IETF community: • IPv6 transition mechanisms • IPv4 multiplexing/sharing mechanisms (e.g., EnIP, A+P) • Efforts to conserve IPv4 address space e.g., draft-fleischhauer-ipv4-addr-saving-05, RFC6346, draft-chimiak-enhanced-ipv4-03 IANA/Regional Internet Registries: • Establishment of address transfer policies • Incentives for increasing address space utilization Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 2
Academic Community Efforts • Measurements to understand “where we are” right now • Internet-wide: Number of actively used IPv4 addresses: “1.2B IP addresses in use in 2014”, statistical estimation Zander et al., IMC ‘14 “5.3M /24 address blocks in use in 2013”, passive+active measurement Dainotti et al., JSAC ‘16 • Challenge: No single vantage point captures all activity Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 3
Academic Community Efforts • Measurements to understand “where we are” right now • Internet-wide: Number of actively used IPv4 addresses: “1.2B IP addresses in use in 2014”, statistical estimation Zander et al., IMC ‘14 “5.3M /24 address blocks in use in 2013”, passive+active measurement Dainotti et al., JSAC ‘16 • Challenge: No single vantage point captures all activity What can we say from our CDN’s perspective? Can we do more than counting active IP addresses? Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 3
The CDN as an Observatory CDN front-end servers • 200,000+ servers • 3 trillion requests per day • CDN logs: number of requests per IP per day HTTP(S) requests Totals for the entirety of 2015: • 1.2B active IPv4 addresses (42% of routed) • 6.5M active /24 address blocks (59% of routed) Visibility: CDN logs vs. ICMP scan (ZMap project, 8 snapshots) CDN & ICMP ICMP only CDN only 0 20 40 60 80 100 % IPv4 addresses visibly active (N=950M, Oct. 2015) Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 4
Peak IPv4? 1B unique active IPv4 addresses per month ● linear regression until 2014 − 01 ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● 800M ● ● ● ● ● ● ● unique IPv4 addresses ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● 600M ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● 400M ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● IANA exhaustion ARIN exhaustion ● ● ● ● ● ● ● RIPE exhaustion ● ● ● ● ● 200M APNIC exhaustion LACNIC exhaustion 2008 2009 2010 2011 2012 2013 2014 2015 2016 date [ticks: January of each year] Active IPv4 address counts have stagnated since 2014 Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 5
Daily IPv4 Activity and Churn ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● 600M ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● unique IPv4 addresses 400M active IPv4 addresses ● up events down events 200M 0 0 14 28 42 56 70 84 98 112 days from 2015 − 08 − 17 to 2015 − 12 − 06 Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 6
Churn on all Timescales day-to-day: ~7% come, ~7% go week-to-week: ~5% come, ~5% go month-to-month: ~5% come, ~5% go The number of active IPv4 addresses stays constant the set of active addresses varies on all timescales Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 7
Long-term Effect of Address Churn 200M 25% change in active IPv4 addresses appear 12.5% 100M 0 0 − 12.5% − 100M disappear − 200M − 25% 1 week 26 weeks 52 weeks time lag from 2015 − 01 − 01 Over the course of one year, 25% of the active IP address pool changed Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 8
Address Activity Matrix … address space 130.149.0.6 130.149.0.5 130.149.0.4 130.149.0.3 130.149.0.2 130.149.0.1 … days for each day on which an IP address was active (requested content), we draw a red dot. Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 9
Patterns: “In situ” Address Activity .255 .255 IP address activity within /24 IP address activity within /24 .127 .127 “in situ” activity: address assignment practice .0 .0 + 0 1 2 3 4 0 1 2 3 4 time [months] time [months] user behavior static block DE University DHCP pool US University .255 .255 (no visible modification of IP address activity within /24 IP address activity within /24 address assignment practice) .127 .127 .0 .0 0 1 2 3 4 0 1 2 3 4 time [months] time [months] residential users US ISP residential users DE ISP Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 10
Patterns: Operational Change .255 .255 IP address activity within /24 IP address activity within /24 .127 .127 .0 .0 0 1 2 3 4 0 1 2 3 4 time [months] time [months] DE University DE University Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 11
Activity Matrix at Scale 20k adjacent IP addresses (in active /24s), University Network Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 12
Metric 1: Filling Degree per /24 Number of active IP addresses per /24 [1…256] .255 .255 IP address activity within /24 IP address activity within /24 .127 .127 .0 .0 0 1 2 3 4 0 1 2 3 4 time [months] time [months] rather low high (degree = 29) (degree = 254) Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 13
Metric 1: Filling Degree per /24 1.0 0.8 CDF: active /24 blocks 0.6 0.4 0.2 0.0 1 64 128 192 256 active IP addresses within /24 Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 14
Metric 1: Filling Degree per /24 1.0 0.8 CDF: active /24 blocks 0.6 0.4 only less than 50% of all 0.2 active /24 blocks have filling degree > 250 0.0 1 64 128 192 256 active IP addresses within /24 Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 14
Addressing: Static vs. Dynamic 1.0 static all dynamic 0.8 CDF: active /24 blocks 0.6 0.4 0.2 0.0 1 64 128 192 256 active IP addresses within /24 • We tagged likely static/dynamic blocks using PTR records • We identified 262K static blocks and 456K dynamic blocks Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 14
Addressing: Static vs. Dynamic 1.0 static all dynamic 0.8 CDF: active /24 blocks 0.6 0.4 0.2 more than 70% 0.0 of “static”-tagged blocks 1 64 128 192 256 have filling degree < 64 active IP addresses within /24 • We tagged likely static/dynamic blocks using PTR records • We identified 262K static blocks and 456K dynamic blocks Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 14
Addressing: Static vs. Dynamic 1.0 static all dynamic more than 80% of 0.8 CDF: active /24 blocks “dynamic”-tagged blocks have filling degree > 250 0.6 0.4 0.2 more than 70% 0.0 of “static”-tagged blocks 1 64 128 192 256 have filling degree < 64 active IP addresses within /24 • We tagged likely static/dynamic blocks using PTR records • We identified 262K static blocks and 456K dynamic blocks Philipp Richter | INET / TU Berlin http://arxiv.org/abs/1606.00360 14
Recommend
More recommend
