Ramakrishna Padmanabhan
Amogh Dhamdhere
ABSTRACT
Applications often use IP addresses as end host identifiers based on the assumption that IP addresses do not change frequently, even when dynamically assigned. The validity of this assumption depends upon the duration of time that an IP address continues to be assigned to the same end host, and this duration in turn, depends upon the various causes that can induce the currently assigned IP address to change. In this work, we identify different causes that can lead to an address change and analyze their effect in ISPs around the world using data gathered from 3,038 RIPE Atlas probes hosted across 929 ASes and 156 countries across all 12 months of 2015. Our observations reveal information about ISP practices, outages, and dynamic address prefixes. For example, we found 20 ISPs around the world that periodically reassign addresses after a fixed period, typically a multiple of 24 hours. We also found that address changes are correlated with network and power outages occurring at customer premises equipment (CPE) devices. Furthermore, almost half of the address changes we observed on the same CPE were to an entirely different BGP-routed prefix.
- Dennis Andriesse, Christian Rossow, and Herbert Bos. Reliable recon in adversarial peer-to-peer botnets. In IMC, 2015. Google Scholar
Digital Library
- Oded Argon, Anat Bremler-Barr, Osnat Mokryn, Dvir Schirman, Yuval Shavitt, and Udi Weinsberg. On the dynamics of IP address allocation and availability of end-hosts. arXiv preprint arXiv:1011.2324, 2010.Google Scholar
- About RIPE Atlas: FAQ: How does the probe connect to the Internet? https://atlas.ripe.net/about/faq/.Google Scholar
- R. Braden, Editor. Requirements for internet hosts -- communication layers. IETF RFC-1122, October 1989. Google ScholarDigital Library
- Vladimir Brik, Jesse Stroik, and Suman Banerjee. Debugging DHCP performance. In IMC, 2004. Google ScholarDigital Library
- CAIDA. Routeviews prefix to as mappings dataset (pfx2as) for IPv4 and IPv6. https://www.caida.org/data/routing/routeviews-prefix2as.xml.Google Scholar
- Martin Casado and Michael J. Freedman. Peering through the shroud: The effect of edge opacity on IP-based client identification. In NSDI, 2007. Google ScholarDigital Library
- The CBL. http://www.abuseat.org/.Google Scholar
- Jacky C. Chu, Kevin S. Labonte, and Brian N. Levine. Availability and locality measurements of peer-to-peer file systems. In ITCom: Scalability and Traffic Control in IP Networks, 2002.Google ScholarCross Ref
- Ralph Droms. Dynamic Host Configuration Protocol. IETF RFC-2131, March 1997.Google Scholar
- Fail2ban. http://www.fail2ban.org/.Google Scholar
- Zwangstrennung (Forced IP address change). https://de.wikipedia.org/wiki/Zwangstrennung.Google Scholar
- John Heidemann, Yuri Pradkin, Ramesh Govindan, Christos Papadopoulos, Genevieve Bartlett, and Joseph Bannister. Census and Survey of the Visible Internet. In IMC, 2008. Google ScholarDigital Library
- Philip Homburg. NTP measurements with RIPE Atlas. https://labs.ripe.net/Members/philip_homburg/ntp-measurements-with-ripe-atlas, February 2015.Google Scholar
- Jaeyeon Jung and Emil Sit. An empirical study of spam traffic and the use of DNS black lists. In IMC, 2004. Google ScholarDigital Library
- Andrew J. Kaizer and Minaxi Gupta. Open resolvers: Understanding the origins of anomalous open DNS resolvers. In PAM, 2015.Google Scholar
- Manas Khadilkar, Nick Feamster, Matt Sanders, and Russ Clark. Usage-based DHCP lease time optimization. In IMC, 2007. Google ScholarDigital Library
- Marc Kührer, Thomas Hupperich, Jonas Bushart, Christian Rossow, and Thorsten Holz. Going wild: Large-scale classification of open DNS resolvers. In IMC, 2015. Google ScholarDigital Library
- Gregor Maier, Anja Feldmann, Vern Paxson, and Mark Allman. On dominant characteristics of residential broadband internet traffic. In IMC, 2009. Google ScholarDigital Library
- Glenn McGregor. The PPP Internet Protocol Control Protocol (IPCP). IETF RFC-1332, May 1992. Google ScholarDigital Library
- Giovane CM Moura, Carlos Ganán, Qasim Lone, Payam Poursaied, Hadi Asghari, and Michel van Eeten. How dynamic is the isps address space? towards internet-wide dhcp churn estimation. IFIP, 2015.Google ScholarCross Ref
- Thomas Narten, Richard Draves, and Suresh Krishnan. Privacy extensions for stateless address autoconfiguration in ipv6. IETF RFC-4941, September 2007.Google Scholar
- Ioannis Papapanagiotou, Erich M. Nahum, and Vasileios Pappas. Configuring DHCP leases in the smartphone era. In IMC, 2012. Google ScholarDigital Library
- David Plonka and Arthur Berger. Temporal and spatial classification of active IPv6 addresses. In IMC, 2015. Google ScholarDigital Library
- Moheeb Abu Rajab, Jay Zarfoss, Fabian Monrose, and Andreas Terzis. My botnet is bigger than yours (maybe, better than yours): why size estimates remain challenging. In Proceedings of the 1st USENIX Workshop on Hot Topics in Understanding Botnets, Cambridge, USA, 2007. Google ScholarDigital Library
- Philipp Richter, Georgios Smaragdakis, David Plonka, and Arthur Berger. Beyond Counting: New Perspectives on the Active IPv4 Address Space. In IMC, 2016. Google ScholarDigital Library
- RIPE NCC. Atlas. http://atlas.ripe.net.Google Scholar
- RIPE NCC. Become a ripe atlas probe host. https://atlas.ripe.net/get-involved/become-a-host/.Google Scholar
- RIPE NCC. Built-in measurements. https://atlas.ripe.net/docs/built-in/.Google Scholar
- RIPE NCC. RIPE atlas connection logs url format. https://atlas.ripe.net/probes/prb_id/connection-history/yyyy/mm/.Google Scholar
- RIPE NCC. RIPE atlas probe archive. https://atlas.ripe.net/api/v1/probe-archive/.Google Scholar
- RIPE NCC. Technical updates. https://atlas.ripe.net/resources/announcements/.Google Scholar
- RIPE NCC Staff. RIPE Atlas: A global internet measurement network. Internet Protocol Journal, 18(3), September 2015.Google Scholar
- Stefan Saroiu, P. Krishna Gummadi, and Steven D Gribble. Measurement study of peer-to-peer file sharing systems. In MMCN, 2002.Google Scholar
- Aaron Schulman and Neil Spring. Pingin' in the rain. In IMC, 2011. Google ScholarDigital Library
- Vyas Sekar, Yinglian Xie, Michael K. Reiter, and Hui Zhang. A multi-resolution approach for worm detection and containment. In DSN, 2006. Google ScholarDigital Library
- Subhabrata Sen and Jia Wang. Analyzing peer-to-peer traffic across large networks. IEEE/ACM Transactions on Networking (ToN), 12(2):219--232, 2004. Google ScholarDigital Library
- Yuval Shavitt and Eran Shir. Dimes: Let the internet measure itself. ACM CCR, 35(5):71--74, 2005. Google ScholarDigital Library
- William Simpson. The Point-to-Point Protocol. IETF RFC-1661, July 1994.Google Scholar
- Sorbs (spam and open-relay blocking system). www.sorbs.net/.Google Scholar
- The spamhaus project. http://www.spamhaus.org/.Google Scholar
- Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski, Richard Kemmerer, Christopher Kruegel, and Giovanni Vigna. Your botnet is my botnet: analysis of a botnet takeover. In Proceedings of the 16th ACM conference on Computer and communications security, 2009. Google ScholarDigital Library
- Tech stuff - static and dynamic IP addresses. http://www.zytrax.com/isp/faqs/static.htm.Google Scholar
- Why does my external IP change every day? http://www.makeuseof.com/answers/why-does-my-external-ip-change-every-day/, June 2013.Google Scholar
- Why does your IP address change now and then? http://whatismyipaddress.com/keeps-changing.Google Scholar
- Why do ISPs change your IP address? http://www.howtogeek.com/163747/why-do-isps-change-your-ip-address/.Google Scholar
- Yinglian Xie, Vyas Sekar, David Maltz, Michael K. Reiter, Hui Zhang, et al. Worm origin identification using random moonwalks. In Proc. of the IEEE Symposium on Security and Privacy, 2005. Google ScholarDigital Library
- Yinglian Xie, Fang Yu, Kannan Achan, Eliot Gillum, Moises Goldszmidt, and Ted Wobber. How dynamic are IP addresses? In ACM SIGCOMM, 2007. Google ScholarDigital Library
Index Terms
- Reasons Dynamic Addresses Change
Recommendations
How dynamic are IP addresses?
SIGCOMM '07: Proceedings of the 2007 conference on Applications, technologies, architectures, and protocols for computer communicationsThis paper introduces a novel algorithm, UDmap, to identify dynamically assigned IP addresses and analyze their dynamics pattern. UDmap is fully automatic, and relies only on application-level server logs. We applied UDmap to a month-long Hotmail user-...
Comments