Observed Structure of Addresses in IP Traffic

Authors: Eddie Kohler, Jinyang Li, Vern Paxson, and Scott Shenker

Complete Citation

Eddie Kohler, Jinyang Li, Vern Paxson, and Scott Shenker, Observed Structure of Addresses in IP Traffic, IEEE/ACM Transactions on Networking (TON), Volume 14, Issue 6, Pages: 1207 - 1218, DOI Bookmark: 10.1109/TNET.2006.886288

Abstract

We investigate the structure of addresses contained in IPv4 traffic—specifically, the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. Several example address structures are well modeled by multifractal Cantor-like sets with two parameters. This model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful “fingerprints” of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these fingerprints.

Annotations

This paper studied the structure of destination IP addresses contained in IPv4 traffic. Then, it proposed a multifractal model to match the properties of the address structures.

• Complementary CDF of the packet counts of flows, addresses, and 16-aggregates in R1 data set: All three distributions appear to have power law tails. The 16-aggregate packet count distribution should be less heavy-tailed?
  

• Complementary CDF of the packet counts before and after worms hit: The distribution with worm drops, since many aggregates have been added that contain only unsuccessful probes.