Dynamic address durations in RIPE Atlas probes Ramakrishna - PowerPoint PPT Presentation

Dynamic address durations in RIPE Atlas probes Ramakrishna Padmanabhan, Emile Aben, Amogh Dhamdhere, kc claffy, Neil Spring 1

Dynamic address: 1.2.3.4 How long does a public dynamic address last on a device? 2

How long does a public dynamic address last on a device? Home Network 1.2.3.4 Internet 3

How long does a public dynamic address last on a device? Central Home Network Controller 1.2.3.4 Internet Probes report measurements to central controller over TCP Controller records these TCP connections in connection logs 4

Find address changes using probes’ TCP connection logs Jan 1 Jan 2 Jan 3 Jan 4 5

Find address changes using probes’ TCP connection logs IP 2 Jan 1 Jan 2 Jan 3 Jan 4 5

Find address changes using probes’ TCP connection logs IP 3 IP 2 Jan 1 Jan 2 Jan 3 Jan 4 5

Find address changes using probes’ TCP connection logs IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 5

Find address changes using probes’ TCP connection logs Renumbering triggers IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 5

Find address changes using probes’ TCP connection logs Renumbering triggers IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 Investigate renumbering triggers to find expected duration 5

Investigate renumbering triggers to find expected duration Do ISPs intentionally renumber? Do users cause renumbering? 6

Investigate renumbering triggers to find expected duration Do ISPs intentionally renumber? Do users cause renumbering? 6

Do ISPs trigger renumbering? AS Name Country # Probes AS3215 Orange France 121 AS3320 Deutsche Telekom (DT) Germany 68 AS701 Verizon US 40 Inspect weighted distribution of address-durations 7

Find address durations IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 Address Duration (hours) IP 1 79.194.205.144 NA IP 2 79.194.192.169 24 IP 3 79.194.196.241 24 IP 4 79.194.194.4 12 IP 5 91.9.219.235 NA 8

Find address durations IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 Address Duration (hours) IP 1 79.194.205.144 NA IP 2 79.194.192.169 24 IP 3 79.194.196.241 24 IP 4 79.194.194.4 12 IP 5 91.9.219.235 NA Sum: 60 8

Plot weighted CDF Fraction of total address-duration 1.0 Address Duration 0.8 Probe 16893: 60 hours (hours) IP 1 79.194.205.144 NA 0.6 IP 2 79.194.192.169 24 0.4 IP 3 79.194.196.241 24 IP 4 0.2 79.194.194.4 12 IP 5 91.9.219.235 NA 0.0 0 5 10 15 20 24 Sum: 60 IP address-duration (hours) If some durations are observed more often than others, could indicate ISP-triggered renumbering 9

Orange, DT have characteristic address- durations Fraction of total address-duration 1.0 AS3215 Orange 0.8 AS3320 DT 0.6 AS701 Verizon 0.4 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale)

Orange, DT have characteristic address- durations Fraction of total address-duration 1.0 AS3215 Orange 0.8 AS3320 DT 0.6 AS701 Verizon 0.4 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale)

Is it common for ASes to have characteristic address-durations? 11

Several ASes have characteristic address-durations AS3215 Orange Fraction of total address-duration 1.0 AS3320 DT 0.8 AS5432 Proximus AS3209 0.6 Vodafone DE AS13184 0.4 Telefonica DE AS6805 Telefonica DE 0.2 AS9198 JSC Kazakh 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale)

Several ASes have characteristic address-durations AS3215 Orange Fraction of total address-duration 1.0 AS3320 DT 0.8 AS5432 Proximus AS3209 0.6 Vodafone DE AS13184 0.4 Telefonica DE AS6805 Telefonica DE 0.2 AS9198 JSC Kazakh 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale)

Several ASes have characteristic address-durations AS3215 Orange Fraction of total address-duration 1.0 AS3320 DT 0.8 AS5432 Proximus AS3209 0.6 Vodafone DE AS13184 0.4 Telefonica DE AS6805 Telefonica DE 0.2 AS9198 JSC Kazakh 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale)

German ASes have characteristic 24-hour address-durations Fraction of total address-duration 1.0 AS3320 DT 0.8 AS3209 Vodafone DE AS13184 0.6 Telefonica DE AS6805 0.4 Telefonica DE AS31334 Kabel DE 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale)

German ASes have characteristic 24-hour address-durations Fraction of total address-duration 1.0 AS3320 DT 0.8 AS3209 Vodafone DE AS13184 0.6 Telefonica DE AS6805 0.4 Telefonica DE AS31334 Kabel DE 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale)

Characteristic durations exist. How are they distributed among probes? 14

How are characteristic durations distributed among DT and Orange probes? Fraction of total address-duration 1.0 AS3215 Orange 0.8 AS3320 DT 0.6 0.4 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale) 15

How are characteristic durations distributed among DT and Orange probes? Fraction of total address-duration 1.0 0.8 AS3215 Orange (45y) 0.6 0.4 AS3320 DT (28y) 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale) 16

How are characteristic durations distributed among DT and Orange probes? Hypothetical Address-durations 3 7 24 Fraction of total address-duration 1.0 72 0.8 AS3215 136 Orange (45y) 0.6 168 0.4 AS3320 168 DT (28y) 0.2 168 0.0 168 1h 6h 12h 1d 3d 1w 2w 1mo 2mo IP address-duration (log-scale) 168 168 168 16

How are characteristic durations distributed among DT and Orange probes? Hypothetical Address-durations 3 7 24 72 136 168 168 168 168 168 168 168 17

How are characteristic durations distributed among DT and Orange probes? Hypothetical Address-durations Probe 1 Probe 2 Probe 3 Probe 4 3 168 168 3 7 7 168 168 168 72 24 168 168 24 136 72 136 168 168 168 168 168 168 168 17

How are characteristic durations distributed among DT and Orange probes? Hypothetical Address-durations Probe 1 Probe 2 Probe 3 Probe 4 3 168 168 3 7 7 168 168 168 72 24 168 168 24 136 72 136 (or) 168 168 168 168 168 168 168 17

How are characteristic durations distributed among DT and Orange probes? Hypothetical Address-durations Probe 1 Probe 2 Probe 3 Probe 4 3 168 168 3 7 7 168 168 168 72 24 168 168 24 136 72 136 (or) 168 Probe 1 Probe 2 Probe 3 Probe 4 168 3 24 168 7 168 168 168 168 168 168 168 168 168 7 136 168 168 17

How are characteristic durations distributed among DT and Orange probes? Hypothetical Address-durations Probe 1 Probe 2 Probe 3 Probe 4 3 168 168 3 7 7 168 168 168 72 24 168 168 24 136 72 136 (or) 168 Probe 1 Probe 2 Probe 3 Probe 4 168 3 24 168 7 168 168 168 168 168 168 168 168 168 7 136 168 168 Inspect avg address-duration per probe 17

Inspect avg. address-duration per probe 1.0 AS3215 0.8 Orange (121) Fraction of probes AS3320 0.6 DT (68) 0.4 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo Average IP address-durations (log-scale) Shorter durations interspersed with characteristic durations 18

Inspect avg. address-duration per probe 1.0 AS3215 0.8 Orange (121) Fraction of probes AS3320 No modes at 0.6 DT (68) characteristic durations 0.4 0.2 0.0 1h 6h 12h 1d 3d 1w 2w 1mo 2mo Average IP address-durations (log-scale) Shorter durations interspersed with characteristic durations 18

Perhaps there are other triggers for renumbering? 19

Investigate renumbering triggers to find expected duration Do ISPs intentionally renumber? Do users cause renumbering? 20

Investigate renumbering triggers to find expected duration Do ISPs intentionally renumber? Do users cause renumbering? 20

Use Uptime counter data from RIPE Atlas to infer reboots Renumbering triggers IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 21

Use Uptime counter data from RIPE Atlas to infer reboots Renumbering triggers IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 RIPE Atlas records uptime counter values for probes 21

Use Uptime counter data from RIPE Atlas to infer reboots Renumbering triggers IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 10579252 10665721 10752010 56 RIPE Atlas records uptime counter values for probes 21

Use Uptime counter data from RIPE Atlas to infer reboots Renumbering triggers ✘ IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 10579252 10665721 10752010 56 RIPE Atlas records uptime counter values for probes 21

Use Uptime counter data from RIPE Atlas to infer reboots Renumbering triggers ✘ IP 5 IP 4 IP 3 IP 2 IP 1 Jan 1 Jan 2 Jan 3 Jan 4 ✘ 10579252 10665721 10752010 56 If shared RIPE Atlas records uptime counter values for probes fate 21

When reboots occur, how often do address changes occur? Find fraction of reboots that occurred with a renumbering per probe and CDF • If fraction == 0, no reboots occurred with an address change • If fraction == 1, all reboots occurred with an address change 22