how dynamic is the isps address space towards internet
play

How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP - PowerPoint PPT Presentation

How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation Giovane C. M. Moura , Carlos Gan, Qasim Lone, Payam Poursaied, Hadi Asghari, and Michel van Eeten


  1. How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation Giovane C. M. Moura ⋆ , Carlos Gañán, Qasim Lone, Payam Poursaied, Hadi Asghari, and Michel van Eeten ❣✐♦✈❛♥❡✳♠♦✉r❛❅s✐❞♥✳♥❧ Delft University of Technology ⋆ SIDN Labs IRTF & ISOC Workshop on Research and Applications of Internet Measurements (RAIM) Saturday, October 31, 2015 Yokohama, Japan

  2. Paper in a nutshell ◮ Problem: bot counts based on IPs counts are flawed ◮ Why? DHCP churn ◮ Torpig paper showed that DE bots 4x more IPs than US ◮ Fix: need to compensate for DHCP churn ◮ OK, so how to measure churn? ◮ It’s been done (passively), small scale (not ISP wide) ◮ Need to scale-up ; ISP-independent

  3. Internet-wide DHCP churn measurement Our Method 1. Probe: continuous ICMP probes on entire ASes, every 10min ◮ ◮ Based on the Internet Census paper 2. DHCP session estimation: Interpolate consecutively ack’ed packets ◮ Missing ack: session expired ◮ More complex: see paper 3. Validation: mid-size ISP (1 M IP addresses) ◮ Radius Logs vs measured DHCP sessions ◮ 2 weeks period

  4. Ground truth: what we try to measure 20 Number of IPs Number of IPs per user per day 15 10000 20000 10 30000 5 0 NAS Groups Figure: Pools of addresses (NAS) and average daily User/IP

  5. plotly BETA Sign in Sign up  NEW PROJECT error-bar-bar Made by krlosbcn Last edited a few seconds ago  Public  Fork and edit  View full-size graph        PLOT Validation DATA DHCP churn CODE Estimated churn 1 6 Number of IPs per user per day 1 4 1 2 1 0 8 6 4 2 0 NAS-117 NAS-147 NAS-149 NAS-157 NAS-165 NAS-171 NAS-172 NAS-173 NAS-175 NAS-183 NAS-198 NAS-199 NAS-202 NAS-204 NAS-205 NAS-207 NAS-209 NAS-214 NAS-215 NAS-216 NAS-223 NAS-226 NAS-235 NAS-236 NAS-237 NAS-238 NAS-239 NAS-240 NAS-241 NAS-244 NAS-246 NAS-247 NAS-51 NAS-71 and graph »       ◮ 72.3% average precision in our model matlab 0 comments ◮ Simple method that works on a highly dynamic network

  6. Now, measure other ASes 1 0.8 0.6 0.4 0.2 0 AT&T BT DT OR T el Static Low-Dyn Hi-Dyn ◮ Employed k-means to 5 ASes of large ISPs ◮ Fastrack Elsevier ComCom Paper (under review) ◮ 2nd validation: RIPE Atlas (works better) ◮ Next: normalize bot counts

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend