Dynamic address durations in RIPE Atlas probes Ramakrishna - - PowerPoint PPT Presentation

▶
dynamic address durations in ripe atlas probes
SMART_READER_LITE
LIVE PREVIEW

Dynamic address durations in RIPE Atlas probes Ramakrishna - - PowerPoint PPT Presentation

Jan 19, 2023 48 likes •523 views

Dynamic address durations in RIPE Atlas probes Ramakrishna Padmanabhan, Emile Aben, Amogh Dhamdhere, kc claffy, Neil Spring 1 Dynamic address: 1.2.3.4 How long does a public dynamic address last on a device? 2 How long does a public

slide-1
SLIDE 1

Dynamic address durations in RIPE Atlas probes

Ramakrishna Padmanabhan, Emile Aben, Amogh Dhamdhere, kc claffy, Neil Spring

1

slide-2
SLIDE 2

How long does a public dynamic address last on a device?

Dynamic address: 1.2.3.4

2

slide-3
SLIDE 3

How long does a public dynamic address last on a device?

3

1.2.3.4 Home Network

Internet

slide-4
SLIDE 4

How long does a public dynamic address last on a device?

4

1.2.3.4 Home Network

Internet

Central Controller

Probes report measurements to central controller over TCP Controller records these TCP connections in connection logs

slide-5
SLIDE 5

Jan 1 Jan 2 Jan 3 Jan 4

Find address changes using probes’ TCP connection logs

5

slide-6
SLIDE 6

Jan 1 Jan 2 Jan 3 Jan 4 IP2

Find address changes using probes’ TCP connection logs

5

slide-7
SLIDE 7

Jan 1 Jan 2 Jan 3 Jan 4 IP2 IP3

Find address changes using probes’ TCP connection logs

5

slide-8
SLIDE 8

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Find address changes using probes’ TCP connection logs

5

slide-9
SLIDE 9

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Renumbering triggers

Find address changes using probes’ TCP connection logs

5

slide-10
SLIDE 10

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Renumbering triggers

Find address changes using probes’ TCP connection logs

Investigate renumbering triggers to find expected duration

5

slide-11
SLIDE 11

6

Investigate renumbering triggers to find expected duration

Do ISPs intentionally renumber? Do users cause renumbering?

slide-12
SLIDE 12

6

Investigate renumbering triggers to find expected duration

Do ISPs intentionally renumber? Do users cause renumbering?

slide-13
SLIDE 13

Do ISPs trigger renumbering?

7

AS Name Country # Probes AS3215 Orange France 121 AS3320 Deutsche Telekom (DT) Germany 68 AS701 Verizon US 40

Inspect weighted distribution of address-durations

slide-14
SLIDE 14

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

8

Address Duration (hours) IP1 79.194.205.144 NA IP2 79.194.192.169 24 IP3 79.194.196.241 24 IP4 79.194.194.4 12 IP5 91.9.219.235 NA

Find address durations

slide-15
SLIDE 15

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

8

Address Duration (hours) IP1 79.194.205.144 NA IP2 79.194.192.169 24 IP3 79.194.196.241 24 IP4 79.194.194.4 12 IP5 91.9.219.235 NA

Sum: 60

Find address durations

slide-16
SLIDE 16

9 24 5 10 15 20

IP address-duration (hours)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration Probe 16893: 60 hours

Plot weighted CDF

If some durations are observed more often than others, could indicate ISP-triggered renumbering

Address Duration (hours) IP1 79.194.205.144 NA IP2 79.194.192.169 24 IP3 79.194.196.241 24 IP4 79.194.194.4 12 IP5 91.9.219.235 NA

Sum: 60

slide-17
SLIDE 17

Orange, DT have characteristic address- durations

AS3215 Orange AS701 Verizon AS3320 DT

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

slide-18
SLIDE 18

Orange, DT have characteristic address- durations

AS3215 Orange AS701 Verizon AS3320 DT

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

slide-19
SLIDE 19

Is it common for ASes to have characteristic address-durations?

11

slide-20
SLIDE 20

Several ASes have characteristic address-durations

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

AS5432 Proximus AS3209 Vodafone DE AS13184 Telefonica DE AS6805 Telefonica DE AS9198 JSC Kazakh AS3320 DT AS3215 Orange

slide-21
SLIDE 21

Several ASes have characteristic address-durations

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

AS5432 Proximus AS3209 Vodafone DE AS13184 Telefonica DE AS6805 Telefonica DE AS9198 JSC Kazakh AS3320 DT AS3215 Orange

slide-22
SLIDE 22

Several ASes have characteristic address-durations

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

AS5432 Proximus AS3209 Vodafone DE AS13184 Telefonica DE AS6805 Telefonica DE AS9198 JSC Kazakh AS3320 DT AS3215 Orange

slide-23
SLIDE 23

German ASes have characteristic 24-hour address-durations

AS3209 Vodafone DE AS13184 Telefonica DE AS6805 Telefonica DE AS31334 Kabel DE AS3320 DT

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

slide-24
SLIDE 24

German ASes have characteristic 24-hour address-durations

AS3209 Vodafone DE AS13184 Telefonica DE AS6805 Telefonica DE AS31334 Kabel DE AS3320 DT

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

slide-25
SLIDE 25

Characteristic durations exist. How are they distributed among probes?

14

slide-26
SLIDE 26

How are characteristic durations distributed among DT and Orange probes?

15

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

AS3215 Orange AS3320 DT

slide-27
SLIDE 27

16

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

AS3320 DT (28y) AS3215 Orange (45y)

How are characteristic durations distributed among DT and Orange probes?

slide-28
SLIDE 28

16

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

IP address-duration (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of total address-duration

AS3320 DT (28y) AS3215 Orange (45y)

How are characteristic durations distributed among DT and Orange probes?

Hypothetical Address-durations 3 7 24 72 136 168 168 168 168 168 168 168

slide-29
SLIDE 29

17

How are characteristic durations distributed among DT and Orange probes?

Hypothetical Address-durations 3 7 24 72 136 168 168 168 168 168 168 168

slide-30
SLIDE 30

17

How are characteristic durations distributed among DT and Orange probes?

Probe 1 Probe 2 Probe 3 Probe 4 168 168 3 7 168 168 168 72 168 168 24 136 Hypothetical Address-durations 3 7 24 72 136 168 168 168 168 168 168 168

slide-31
SLIDE 31

17

How are characteristic durations distributed among DT and Orange probes?

Probe 1 Probe 2 Probe 3 Probe 4 168 168 3 7 168 168 168 72 168 168 24 136 Hypothetical Address-durations 3 7 24 72 136 168 168 168 168 168 168 168

(or)

slide-32
SLIDE 32

17

How are characteristic durations distributed among DT and Orange probes?

Probe 1 Probe 2 Probe 3 Probe 4 168 168 3 7 168 168 168 72 168 168 24 136 Hypothetical Address-durations 3 7 24 72 136 168 168 168 168 168 168 168 Probe 1 Probe 2 Probe 3 Probe 4 3 24 168 7 168 168 168 168 168 168 7 136

(or)

slide-33
SLIDE 33

17

How are characteristic durations distributed among DT and Orange probes?

Probe 1 Probe 2 Probe 3 Probe 4 168 168 3 7 168 168 168 72 168 168 24 136 Hypothetical Address-durations 3 7 24 72 136 168 168 168 168 168 168 168 Probe 1 Probe 2 Probe 3 Probe 4 3 24 168 7 168 168 168 168 168 168 7 136

(or)

Inspect avg address-duration per probe

slide-34
SLIDE 34

18

AS3215 Orange (121) AS3320 DT (68)

Inspect avg. address-duration per probe

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

Average IP address-durations (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of probes

Shorter durations interspersed with characteristic durations

slide-35
SLIDE 35

18

AS3215 Orange (121) AS3320 DT (68)

Inspect avg. address-duration per probe

1h 6h 12h 1d 3d 1w 2w 1mo 2mo

Average IP address-durations (log-scale)

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of probes

Shorter durations interspersed with characteristic durations

No modes at characteristic durations

slide-36
SLIDE 36

Perhaps there are other triggers for renumbering?

19

slide-37
SLIDE 37

20

Investigate renumbering triggers to find expected duration

Do ISPs intentionally renumber? Do users cause renumbering?

slide-38
SLIDE 38

20

Investigate renumbering triggers to find expected duration

Do ISPs intentionally renumber? Do users cause renumbering?

slide-39
SLIDE 39

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Renumbering triggers

Use Uptime counter data from RIPE Atlas to infer reboots

21

slide-40
SLIDE 40

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Renumbering triggers

Use Uptime counter data from RIPE Atlas to infer reboots

21

RIPE Atlas records uptime counter values for probes

slide-41
SLIDE 41

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Renumbering triggers

Use Uptime counter data from RIPE Atlas to infer reboots

21

10579252 10665721 10752010 56 RIPE Atlas records uptime counter values for probes

slide-42
SLIDE 42

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Renumbering triggers

Use Uptime counter data from RIPE Atlas to infer reboots

21

10579252 10665721 10752010 56

✘

RIPE Atlas records uptime counter values for probes

slide-43
SLIDE 43

Jan 1 Jan 2 Jan 3 Jan 4 IP1 IP2 IP3 IP4 IP5

Renumbering triggers

Use Uptime counter data from RIPE Atlas to infer reboots

21

10579252 10665721 10752010 56

✘ ✘

If shared fate RIPE Atlas records uptime counter values for probes

slide-44
SLIDE 44

When reboots occur, how often do address changes occur?

Find fraction of reboots that occurred with a renumbering per probe and CDF

  • If fraction == 0, no reboots occurred with an

address change

  • If fraction == 1, all reboots occurred with an

address change

22

slide-45
SLIDE 45

23

AS3215 Orange (103) AS3320 DT (52)

Users can trigger address-changes with reboots!

0.2 0.4 0.6 0.8 1.0

Fraction of reboots that occurred with address-changes

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of probes

When reboots occur, how often do address changes occur?

slide-46
SLIDE 46

23

AS3215 Orange (103) AS3320 DT (52)

Users can trigger address-changes with reboots!

0.2 0.4 0.6 0.8 1.0

Fraction of reboots that occurred with address-changes

0.0 0.2 0.4 0.6 0.8 1.0

Fraction of probes For 40% of Atlas probes, all reboots resulted in an address-change

When reboots occur, how often do address changes occur?

slide-47
SLIDE 47

Summary

Investigated renumbering triggers for dynamic addresses in RIPE Atlas probes

  • ISP triggered:
  • Many European Autonomous Systems have

characteristic address-durations

  • User triggered
  • For DT and Orange, reboots are often correlated

with address-changes

24