Beyond Counting: New Perspectives on the Active IPv4 Address Space

TL;DR

This study analyzes global IPv4 activity using large-scale CDN logs, revealing stagnation in IPv4 counts since 2014, significant address churn, and new insights into address utilization and network behaviors.

Contribution

It introduces novel methods for analyzing IPv4 activity at a granular level, highlighting address churn, utilization patterns, and the impact of network restructuring and user behavior.

Findings

IPv4 address counts have stagnated since 2014.

Significant address churn of up to 25% annually.

Evidence of under-utilization and exhaustion in different regions.

Abstract

In this study, we report on techniques and analyses that enable us to capture Internet-wide activity at individual IP address-level granularity by relying on server logs of a large commercial content delivery network (CDN) that serves close to 3 trillion HTTP requests on a daily basis. Across the whole of 2015, these logs recorded client activity involving 1.2 billion unique IPv4 addresses, the highest ever measured, in agreement with recent estimates. Monthly client IPv4 address counts showed constant growth for years prior, but since 2014, the IPv4 count has stagnated while IPv6 counts have grown. Thus, it seems we have entered an era marked by increased complexity, one in which the sole enumeration of active IPv4 addresses is of little use to characterize recent growth of the Internet as a whole. With this observation in mind, we consider new points of view in the study of global IPv4 address activity. Our analysis shows significant churn in active IPv4 addresses: the set of active IPv4 addresses varies by as much as 25% over the course of a year. Second, by looking across the active addresses in a prefix, we are able to identify and attribute activity patterns to network restructurings, user behaviors, and, in particular, various address assignment practices. Third, by combining spatio-temporal measures of address utilization with measures of traffic volume, and sampling-based estimates of relative host counts, we present novel perspectives on worldwide IPv4 address activity, including empirical observation of under-utilization in some areas, and complete utilization, or exhaustion, in others.