> By Yacine Belkessam, Bénédicte Le Grand and Matthieu Latapy
We conduct what we call an Internet radar measurement: from a given machine, called source, and given a set of IP addresses, we perform a traceroute-like measurement towards each of them, and then iterate this operation (200 times here, with a 10mn delay between two consecutive rounds).
Each round of measurement produces an ego-centered view of the internet topology: a set of nodes and links between the source and destinations. Because of various phenomena, in particular load balancing, the observed nodes and links are not the same in consecutive rounds.
Such data may be represented by an adjacency matrix, which consists in a square in which coordinate (x,y) is filled (green) if a link from node x to node y is observed, or empty (black) otherwise. This means that we have to order the nodes vertically and horizontally.
Here, nodes are IP addresses, i.e. 32 bit integers. We selected only the addresses observed during at least one round of measurement, and ordered them according to the natural ordering on integers.
Then, we obtained the video above by drawing the sequence of adjacency matrix of each round (because the number of IP addresses was huge, we displayed only a part of the matrix and zoomed out: each pixel actually represents a set of links).
The presence of many green dots close to the diagonal reveals the fact that consecutive IP addresses (according to their numerical value) tend to be linked together. The presence of rectangular areas with many green dots reveals the fact that sets of consecutive addresses (a subnetwork) tend to be connected to addresses close to each other (another subnetwork).
One may also notice many blinking dots, and even some kinds of synchronization between the appearance and disappearance of links, which is probably due to load balancing.