Ebb and Flow: Implications of ISP Address Dynamics

Abstract

Address dynamics are changes in IP address occupation as users come and go, ISPs renumber them for privacy or for routing maintenance. Address dynamics affect address reputation services, IP geolocation, network measurement, and outage detection, with implications of Internet governance, e-commerce, and science. While prior work has identified diurnal trends in address use, we show the effectiveness of Multi-Seasonal-Trend using Loess (MSTL) decomposition to identify both daily and weekly trends. We use ISP-wide dynamics to develop IAS, a new algorithm that is the first to automatically detect ISP maintenance events that move users in the address space. We show that 20% of such events result in /24 IPv4 address blocks that become unused for days or more, and correcting nearly 41k false outages per quarter. Our analysis provides a new understanding about ISP address use: while only about 2.8% of ASes (1,730) are diurnal, some diurnal ASes show more than 20% changes each day. It also shows greater fragmentation in IPv4 address use compared to IPv6.

Appendices

A Research Ethics

Our work poses no ethical concerns for several reasons.

First, we collect no additional data, but instead reanalyze data from existing sources. Our work therefore poses no additional risk in data collection.

Our analysis poses no risk to individuals because our subject is network topology and connectivity. There is a slight risk to individuals in that we examine responsiveness of individual IP addresses. With external information, IP addresses can sometimes be traced to individuals, particularly when combined with external data sources like DHCP logs. We avoid this risk in three ways. First, we do not have DHCP logs for any networks (and in fact, most are unavailable outside of specific ISPs). Second, we commit, as research policy, to not combine IP addresses with external data sources that might de-anonymize them to individuals. Finally, except for analysis of specific cases as part of validation, all of our analysis is done in bulk over the whole dataset.

We do observe data about organizations such as ISPs, and about the geolocation of blocks of IP addresses. Because we do not map IP addresses to individuals, this analysis poses no individual privacy risk.

Finally, we suggest that while our work poses minimal privacy risks to individuals, to also provides substantial benefit to the community and to individuals. For reasons given in the introduction it is important to improve network reliability and understand how networks fail. Our work contributes to that goal.

Our work was reviewed by the Institutional Review Board at our university and because it poses no risk to individual privacy, it was identified as non-human subjects research (USC IRB IIR00001648).

B A Sample Block with Diurnal Behavior

Fig. 9.

Diurnal blocks in AS9829 observed from Trinocular, Los Angeles, October 2020. Dataset A42.

The block in Fig. 9 from AS9829 shows how one /24 occupancy varies over the course of a day. Green dots show active addresses, and gray non-response. This address block is 50% full every day at its peak, but empty every night. This trend can be seen in the count of active address (the top graph). It causes daily outage events in Trinocular, as shown in the middle graph, showing up most of the day but down every night. Blocks that look like this are common in this AS, and they show the need for our IDD algorithm (Sect. 3.3).

C Does Unmonitored Space Harm IAS?

Measurement systems do not track the complete address space, as some segments are discarded due to low response rate, as well as addresses that historically have not responded [2]. Users reassigned to unmonitored space implies that IAS may erroneously infer outages due to drops in the total active address count, IAS false negatives. To evaluate if unmonitored space interferes with IAS, we count the number of times known VPs move to and from our underlying measurement system’s unmonitored address space. We expect most of VPs to move within monitored addresses, as unmonitored space has been historically unresponsive implying low usage.

Trinocular strives to probe as much as it can (the active addresses), Trinocular excludes addresses for two reasons, inactive addresses used to reply to pings but have not in two years, and non-trackable blocks have less than three responsive addresses.

Table 4. Atlas VP address changes in Trinocular (un)monitored address space.

As with Sect. 4.2, we use RIPE Atlas VPs as ground truth, since they track their current IP addresses. Table 4 counts how many addresses Atlas VPs have in each of the three Trinocular categories (active, inactive, non-trackable).

As expected, the majority of reassignments (51%) occur within monitored addresses (the top, left, green cell). In addition, most addresses (84%) stay in the same category (the diagonal).

A few addresses (7% in the yellow, left column) become active as they move in to measurable space, and about an equal number move out (the 7% in the red, top row). Finally, a surprisingly large 35% are never tracked (the gray region). Since the IAS goal is identify steady or changing addresses, never tracked blocks do not matter. The number that becomes and cease to be active is small (7% each) and about equal in size, so they should not skew IAS. We therefore conclude IAS is not impeded by incomplete measurement.