Interval between the discoveries of IP addresses from several monitors

> Guillaume Valadon, Clémence Magnien and Frédéric Ouédraogo

Interval between the discoveries of IP addresses from several monitors

Interval between the discoveries of IP addresses from several monitors

We performed an experiment similar to Growth of the number of IP around me and Dynamics of IP addresses around me. Here, the measurements were done from eleven monitors probing the same destination set.

We combined the measurements in order to determine if IP addresses are discovered at the same time by the different monitors. We only consider addresses seen by two monitors or more. Then, we compute the interval between the first and the last discovery of such addresses. For example, if the address 1.2.3.4 is seen by monitor A at 7 AM and by monitor B at 11 AM, the interval is four hours.

The Figure represents the complementary cumulative distribution of these interval sizes. A large number of addresses are indeed discovered before with other monitors. Among the 32 228 (out of 40 076) IP addresses seen with at least two monitors, 22 897 were observed with one monitor more than 200 hours before they were discovered by another one, which means that these addresses existed for a long time before they were discovered.

However, this does not tell us whether other addresses existed before their discovery or were created at this time. This indicates that a large number of the IP addresses discovered by a given monitor existed in fact for a significant time before their discovery, and that a routing dynamics between existing addresses plays a strong role in our observations.

This entry was posted in Plots and tagged , , ,