How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation Giovane C. M. Moura ⋆ , Carlos Gañán, Qasim Lone, Payam Poursaied, Hadi Asghari, and Michel van Eeten ❣✐♦✈❛♥❡✳♠♦✉r❛❅s✐❞♥✳♥❧ Delft University of Technology ⋆ SIDN Labs IRTF & ISOC Workshop on Research and Applications of Internet Measurements (RAIM) Saturday, October 31, 2015 Yokohama, Japan
Paper in a nutshell ◮ Problem: bot counts based on IPs counts are flawed ◮ Why? DHCP churn ◮ Torpig paper showed that DE bots 4x more IPs than US ◮ Fix: need to compensate for DHCP churn ◮ OK, so how to measure churn? ◮ It’s been done (passively), small scale (not ISP wide) ◮ Need to scale-up ; ISP-independent
Internet-wide DHCP churn measurement Our Method 1. Probe: continuous ICMP probes on entire ASes, every 10min ◮ ◮ Based on the Internet Census paper 2. DHCP session estimation: Interpolate consecutively ack’ed packets ◮ Missing ack: session expired ◮ More complex: see paper 3. Validation: mid-size ISP (1 M IP addresses) ◮ Radius Logs vs measured DHCP sessions ◮ 2 weeks period
Ground truth: what we try to measure 20 Number of IPs Number of IPs per user per day 15 10000 20000 10 30000 5 0 NAS Groups Figure: Pools of addresses (NAS) and average daily User/IP
plotly BETA Sign in Sign up NEW PROJECT error-bar-bar Made by krlosbcn Last edited a few seconds ago Public Fork and edit View full-size graph PLOT Validation DATA DHCP churn CODE Estimated churn 1 6 Number of IPs per user per day 1 4 1 2 1 0 8 6 4 2 0 NAS-117 NAS-147 NAS-149 NAS-157 NAS-165 NAS-171 NAS-172 NAS-173 NAS-175 NAS-183 NAS-198 NAS-199 NAS-202 NAS-204 NAS-205 NAS-207 NAS-209 NAS-214 NAS-215 NAS-216 NAS-223 NAS-226 NAS-235 NAS-236 NAS-237 NAS-238 NAS-239 NAS-240 NAS-241 NAS-244 NAS-246 NAS-247 NAS-51 NAS-71 and graph » ◮ 72.3% average precision in our model matlab 0 comments ◮ Simple method that works on a highly dynamic network
Now, measure other ASes 1 0.8 0.6 0.4 0.2 0 AT&T BT DT OR T el Static Low-Dyn Hi-Dyn ◮ Employed k-means to 5 ASes of large ISPs ◮ Fastrack Elsevier ComCom Paper (under review) ◮ 2nd validation: RIPE Atlas (works better) ◮ Next: normalize bot counts
Recommend
More recommend