Beruflich Dokumente
Kultur Dokumente
Nb distinct IP
8000 12000
Nb IP
10000
6000 8000
4000 6000
4000
2000
2000
0 0
26/05 02/06 09/06 16/06 23/06 30/06 07/07 14/07 21/07 28/07 04/08 26/05 02/06 09/06 16/06 23/06 30/06 07/07 14/07 21/07 28/07 04/08
Date Date
22000 1400
Nb distinct IP
20000 1200
18000 1000
16000
800
14000
12000 600
10000 400
26/05 02/06 09/06 16/06 23/06 30/06 07/07 14/07 21/07 28/07 04/08
Date 200
26/05 02/06 09/06 16/06 23/06 30/06 07/07 14/07 21/07 28/07 04/08
Date
chosen randomly that replied to ICMP echo request Though it seems natural to observe some new IP ad-
messages at selection time. We kept all the observed IP dresses after some measurement time, this happens here
addresses (and did not remove the first hops needed to get with a surprisingly high rate: during the second month of
out of the monitor’s network). the measurements, around 150 new IP addresses are dis-
covered each day.
We have seen (Figure 1) that the number of IP addresses
3 IP addresses renewal
seen at each round is not increasing. The continuous dis-
covery of new IP addresses must therefore come together
In this section, we describe the evolution of the set of ob- with a continuous disappearance of addresses that we cease
served IP addresses. Figure 1 presents the number of IP ad- to observe after some time. Figure 3 presents this. The dis-
dresses observed in each measurement round. All values in appearances are indeed symmetric with the observation of
this plot are centered around a same value (close to 12 000) new IP addresses 2 .
except some downward peaks which indicate rounds with One possible cause for these observations would be that
less IP addresses than usual. These peaks could indicate a some routers reply with random IP addresses; we will show
loss of connectivity at or near the monitor, or an event such in the next section that it is not the case. Another possi-
as a major routing change or failure. Studying this is how- ble cause would be that some of our destinations are dy-
ever out of the scope of this paper. namic addresses, i.e. dynamically allocated to different
The next question is whether we observe the same IP hosts over time. Since such hosts could be in different loca-
addresses in all rounds. This leads to the plot in Figure 2, tions, depending on network operation, these dynamic ad-
which presents the number of distinct IP addresses observed dresses could lead us to discover new paths and as a result
since the beginning of the measurements as a function of new addresses in the measurements.
time. This plot gives evidence for a striking fact: measure- Figure 4 shows that this is not the case. The idea is
ments continuously discover new IP addresses never seen to select the destinations that were stable during the mea-
before 1 .
2 The plots of Figures 2 and 3 have a similar shape if rotated at a 180◦
1 Other, six-months long, measurements exhibit the same behavior. angle.
2
3500 30000
>= 2
>= 10
3000 >= 50
25000
>= 200
2500 >= 1000
20000
Nb distinct IP
2000
Nb IP
15000
1500
1000 10000
500 5000
0
0
0 1000 2000 3000 4000 5000 6000 26/05 02/06 09/06 16/06 23/06 30/06 07/07 14/07 21/07 28/07 04/08
Nb rounds Date
NB distinct ASes
in the measurements is always the same; 35 out of 3 000 1020
1000
destinations satisfied this condition. We then simulated the 980
measurements by keeping only these stable addresses, and 960
we still clearly see a constant appearance of new IP ad- 940
dresses: dynamic addresses are therefore not the cause of 920 Simulation, Route Views data
Real, Team Cymru data
900
this renewal. Note that our criterion for characterizing sta- 26/05 02/06 09/06 16/06 23/06 30/06 07/07 14/07 21/07 28/07 04/08
ble addresses is very restrictive; we do not imply that the Date
3
1000 largest observed AS 3 . Again in this case we observe the
same type of behavior: we continuously observe new IP
100 addresses in this AS.
Nb distinct IP
the measurements naturally led to the question of whether 1 333 IP addresses (on a total of 29 100).
4 During the year 2007, around 250 ASes were created every month, see
we also observe a renewal of observed IP addresses within http://www.cidr-report.org/as2.0/
a single AS. Figure 9 shows the number of IP addresses 5 This is host route-views.wide.routeviews.org, located in
observed since the beginning of the measurements in the one peering point of the AS where our monitor is located.
4
observations are caused by a dynamics of the BGP routing, 35000
20000
Nb IP
6 Related work 15000
10000
5000
Much work has focused on the measurement bias created
0
by mapping the Internet topology with traceroute-like 0 200 400 600 800 1000 1200 1400
probes. The majority of these works concern the fact that Max interval (in hours)
5
bution of these interval sizes. We observe that a large num- [8] M. Lad, D. Massey, and L. Zhang. Visualizing internet rout-
ber of IP addresses discovered by a given monitor were in ing changes. IEEE Transactions on Visualization and Com-
fact observed a significant duration before with other mon- puter Graphics, special issue on Visual Analytics, 2006.
itors. Among the 32 228 (out of 40 076) IP addresses seen [9] A. Lakhina, J. Byers, M. Crovella, and P. Xie. Sampling
biases in ip topology measurements. In Proc. IEEE INFO-
with at least two monitors, 22 897 were observed with one
COM, 2003.
monitor more than 200 hours before they were discovered
[10] M. Latapy and C. Magnien. Measuring fundamental proper-
by another one, which means that these addresses existed ties of real-world complex networks. In Proc. IEEE INFO-
for a long time before they were discovered. Note that this COM, 2008.
does not tell us whether other addresses existed before their [11] M. Latapy, C. Magnien, and F. Ouédraogo. A radar for the
discovery or were created at this time. This indicates that internet. In Proc. first International Workshop on Analysis of
a large number of the IP addresses discovered by a given Dynamic Networks (ADN), in conjunction with IEEE ICDM
monitor existed in fact for a significant time before their 2008, 2008. To appear. Available at http://arxiv.
discovery, and that a routing dynamics between existing ad- org/abs/0807.1603.
dresses plays a strong role in our observations. [12] T. Moors. Streamlining traceroute by estimating path
lengths. In Proc. IEEE Workshop on IP Operations and
This work should be pursued in several directions. First, Management, Oct. 2004.
we want to fully characterize and understand the renewal of [13] R. Oliveira, B. Zhang, and L. Zhang. Observing the evolu-
observed IP addresses. We think that it is possible to per- tion of internet AS topology. In ACM SIGCOMM, 2007.
form new measurements, specifically designed for answer- [14] V. N. Padmanabhan and L. Subramanian. An investigation
ing the question of whether newly discovered IP addresses of geographic mapping techniques for internet hosts. In SIG-
COMM, 2001.
existed prior to their discovery or not. Another direction
[15] J.-J. Pansiot. Local and dynamic analysis of internet mul-
would be to perform simulations, which would open the ticast router topology. Annales des télécommunications,
way to an accurate modeling of the phenomena causing the 62:408–425, 2007.
renewal of IP addresses. [16] S.-T. Park, A. Khrabrov, D. Pennock, S. Lawrence, C. L.
Second, our work indicates that there is no perfect solu- Giles, and L. Ungar. Static and dynamic analysis of the in-
tion for constructing maps of the Internet topology while a ternet’s susceptibility to faults and attacks. In Proc. IEEE
single measurement round does not discover everything that Infocom, 2003.
can be seen from a monitor (because of load balancing for [17] S.-T. Park, D. M. Pennock, and C. L. Giles. Comparing
instance), aggregating data from several consecutive rounds static and dynamic measurements and models of the inter-
puts together obsolete and up-to-date data. It would be of net’s AS topology. In Proc. IEEE Infocom, 2004.
[18] V. Paxson. End-to-end internet packet dynamics.
prime interest to determine if a best compromise exists, al-
IEEE/ACM Trans. Networking, 7(3):277–292, June 1999.
lowing to construct the most accurate maps, for instance [19] Y. Shavitt and E. Shir. DIMES: Let the internet measure
by tuning the number of measurement rounds and their fre- itself. ACM SIGCOMM Computer Communication Review,
quency. 35(5), 2005.
[20] N. Spring, R. Mahajan, and D. Wetherall. Measuring ISP
References topologies with Rocketfuel. In Proc. ACM SIGCOMM, Aug.
2002.
[21] Team Cymru. http://www.team-cymru.org/.
[1] D. Achlioptas, A. Clauset, D. Kempe, and C. Moore. On the [22] R. Teixeira, K. Marzullo, S. Savage, and G. M. Voelker. In
bias of traceroute sampling. In ACM STOC, 2005. search of path diversity in ISP networks. In Proc. ACM SIG-
[2] CAIDA – Skitter project. http://www.caida.org/
COMM Internet Measurement Conference, Aug. 2003.
tools/measurement/skitter/.
[23] University of Oregon. Route Views, University of Oregon
[3] Q. Chen, H. Chang, R. Govindan, S. Jamin, S. Shenker, and
Route Views project. http://www.antc.uoregon.
W. Willinger. The origin of power laws in internet topologies
edu/route-views/.
revisited. In Proc. IEEE INFOCOM, Jun. 2002.
[24] F. Viger, B. Augustin, X. Cuvellier, B. Orgogozo, T. Fried-
[4] R. Govindan and A. Reddy. An analysis of internet inter-
man, M. Latapy, C. Magnien, and R. Teixeira. Detection
domain topology and route stability. In Proc. IEEE INFO-
and prevention in internet graphs. Computer Networks, 52,
COM, 1997.
[5] J.-L. Guillaume and M. Latapy. Relevance of massively dis- 2008.
tributed explorations of the internet topology: Simulation [25] F. Wang, N. Feamster, and L. Gao. Quantifying the ef-
results. In Proc. IEEE infocom, 2005. fects of routing dynamics on end-to-end internet path fail-
[6] B. Huffaker, D. Plummer, D. Moore, and k. claffy. Topol- ures. Technical report (TR-05-CSE-03) in Department of
ogy discovery by active probing. In Proc. Symposium on Electrical and Computer Engineering in the University of
Applications and the Internet, Jan. 2002. Massachusetts at Amherst, 2006.
[7] C. Labovitz, G. R. Malan, and F. Jahanian. Origins of in-
ternet routing instability. In Proc. IEEE INFOCOM, pages
218–226, 1999.