Beyond Counting: New Perspectives on the Active IPv4 Address Space

ACM Internet Measurement Conference
Santa Monica, CA


In this study, we report on techniques and analyses that enable us to capture Internet-wide activity a t individual IP addresslevel granularity by relying on server logs of a large commercial content delivery network (CDN) that serves close to 3 trillion HTTP requests on a daily basis. Across the whole of 2015, these logs recorde d client activity involving 1.2 billion unique IPv4 addresses, the highest ever measured, in agreement with recent estimates. Monthly client IPv4 address counts showed constant growth for years prior, but since 2014, the IPv4 co unt has stagnated while IPv6 counts have grown. Thus, it seems we have entered an era marked by increased complexi ty, one in which the sole enumeration of active IPv4 addresses is of little use to characterize recent growth of t he Internet as a whole. With this observation in mind, we consider new points of view in the study of global IPv4 address activity. Our analysis shows significant churn in active IPv4 addresses: the set of active IPv4 addresses varies by as much as 25% over the course of a year. Second, by looking across the active addresses in a prefix, w e are able to identify and attribute activity patterns to network restructurings, user behaviors, and, in particul ar, various address assignment practices. Third, by combining spatio-temporal measures of address utilization with measures of traffic volume, and sampling-based estimates of relative host counts, we present novel perspectives o n worldwide IPv4 address activity, including empirical observation of under-utilization in some areas, and complet e utilization, or exhaustion, in others