Observed Structure of Addresses in IP Traffic

Eddie Kohler, Jinyang Li, Vern Paxson, Scott Shenker

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

This paper investigates the structure of addresses contained in IP traffic. Specifically, we analyze the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics may have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. We find that address structures are well modeled by a multifractal Cantor dust with two parameters. The model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful "fingerprints" of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these "fingerprints".

Original languageEnglish (US)
Title of host publicationProceedings of the 2nd Internet Measurement Workshop (IMW 2002)
Pages253-266
Number of pages14
StatePublished - 2002
EventProceedings of the 2nd Internet Measurement Workshop (IMW 2002) - Marseille, France
Duration: Nov 6 2002Nov 8 2002

Other

OtherProceedings of the 2nd Internet Measurement Workshop (IMW 2002)
CountryFrance
CityMarseille
Period11/6/0211/8/02

Fingerprint

Dust
Internet

ASJC Scopus subject areas

  • Engineering(all)

Cite this

Kohler, E., Li, J., Paxson, V., & Shenker, S. (2002). Observed Structure of Addresses in IP Traffic. In Proceedings of the 2nd Internet Measurement Workshop (IMW 2002) (pp. 253-266)

Observed Structure of Addresses in IP Traffic. / Kohler, Eddie; Li, Jinyang; Paxson, Vern; Shenker, Scott.

Proceedings of the 2nd Internet Measurement Workshop (IMW 2002). 2002. p. 253-266.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Kohler, E, Li, J, Paxson, V & Shenker, S 2002, Observed Structure of Addresses in IP Traffic. in Proceedings of the 2nd Internet Measurement Workshop (IMW 2002). pp. 253-266, Proceedings of the 2nd Internet Measurement Workshop (IMW 2002), Marseille, France, 11/6/02.
Kohler E, Li J, Paxson V, Shenker S. Observed Structure of Addresses in IP Traffic. In Proceedings of the 2nd Internet Measurement Workshop (IMW 2002). 2002. p. 253-266
Kohler, Eddie ; Li, Jinyang ; Paxson, Vern ; Shenker, Scott. / Observed Structure of Addresses in IP Traffic. Proceedings of the 2nd Internet Measurement Workshop (IMW 2002). 2002. pp. 253-266
@inproceedings{65b77bb2a4ec44cbb3ae8a102852d162,
title = "Observed Structure of Addresses in IP Traffic",
abstract = "This paper investigates the structure of addresses contained in IP traffic. Specifically, we analyze the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics may have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. We find that address structures are well modeled by a multifractal Cantor dust with two parameters. The model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful {"}fingerprints{"} of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these {"}fingerprints{"}.",
author = "Eddie Kohler and Jinyang Li and Vern Paxson and Scott Shenker",
year = "2002",
language = "English (US)",
isbn = "158113603X",
pages = "253--266",
booktitle = "Proceedings of the 2nd Internet Measurement Workshop (IMW 2002)",

}

TY - GEN

T1 - Observed Structure of Addresses in IP Traffic

AU - Kohler, Eddie

AU - Li, Jinyang

AU - Paxson, Vern

AU - Shenker, Scott

PY - 2002

Y1 - 2002

N2 - This paper investigates the structure of addresses contained in IP traffic. Specifically, we analyze the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics may have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. We find that address structures are well modeled by a multifractal Cantor dust with two parameters. The model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful "fingerprints" of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these "fingerprints".

AB - This paper investigates the structure of addresses contained in IP traffic. Specifically, we analyze the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics may have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. We find that address structures are well modeled by a multifractal Cantor dust with two parameters. The model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful "fingerprints" of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these "fingerprints".

UR - http://www.scopus.com/inward/record.url?scp=0141650502&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=0141650502&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:0141650502

SN - 158113603X

SP - 253

EP - 266

BT - Proceedings of the 2nd Internet Measurement Workshop (IMW 2002)

ER -