how dynamic is the isps address space towards internet
play

How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP - PowerPoint PPT Presentation

How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation Giovane C. M. Moura , Carlos Gan, Qasim Lone, Payam Poursaied, Hadi Asghari, and Michel van Eeten


  1. How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation Giovane C. M. Moura ⋆ , Carlos Gañán, Qasim Lone, Payam Poursaied, Hadi Asghari, and Michel van Eeten ❣✐♦✈❛♥❡✳♠♦✉r❛❅s✐❞♥✳♥❧ Delft University of Technology ⋆ SIDN Labs IRTF & ISOC Workshop on Research and Applications of Internet Measurements (RAIM) Saturday, October 31, 2015 Yokohama, Japan

  2. Paper in a nutshell ◮ Problem: bot counts based on IPs counts are flawed ◮ Why? DHCP churn ◮ Torpig paper showed that DE bots 4x more IPs than US ◮ Fix: need to compensate for DHCP churn ◮ OK, so how to measure churn? ◮ It’s been done (passively), small scale (not ISP wide) ◮ Need to scale-up ; ISP-independent

  3. Internet-wide DHCP churn measurement Our Method 1. Probe: continuous ICMP probes on entire ASes, every 10min ◮ ◮ Based on the Internet Census paper 2. DHCP session estimation: Interpolate consecutively ack’ed packets ◮ Missing ack: session expired ◮ More complex: see paper 3. Validation: mid-size ISP (1 M IP addresses) ◮ Radius Logs vs measured DHCP sessions ◮ 2 weeks period

  4. Ground truth: what we try to measure 20 Number of IPs Number of IPs per user per day 15 10000 20000 10 30000 5 0 NAS Groups Figure: Pools of addresses (NAS) and average daily User/IP

  5. plotly BETA Sign in Sign up  NEW PROJECT error-bar-bar Made by krlosbcn Last edited a few seconds ago  Public  Fork and edit  View full-size graph        PLOT Validation DATA DHCP churn CODE Estimated churn 1 6 Number of IPs per user per day 1 4 1 2 1 0 8 6 4 2 0 NAS-117 NAS-147 NAS-149 NAS-157 NAS-165 NAS-171 NAS-172 NAS-173 NAS-175 NAS-183 NAS-198 NAS-199 NAS-202 NAS-204 NAS-205 NAS-207 NAS-209 NAS-214 NAS-215 NAS-216 NAS-223 NAS-226 NAS-235 NAS-236 NAS-237 NAS-238 NAS-239 NAS-240 NAS-241 NAS-244 NAS-246 NAS-247 NAS-51 NAS-71 and graph »       ◮ 72.3% average precision in our model matlab 0 comments ◮ Simple method that works on a highly dynamic network

  6. Now, measure other ASes 1 0.8 0.6 0.4 0.2 0 AT&T BT DT OR T el Static Low-Dyn Hi-Dyn ◮ Employed k-means to 5 ASes of large ISPs ◮ Fastrack Elsevier ComCom Paper (under review) ◮ 2nd validation: RIPE Atlas (works better) ◮ Next: normalize bot counts

Recommend


More recommend