Back-to-the-Future Whois: An IP Address Attribution Service for Working with Historic Datasets

TL;DR

This paper introduces 'Back-to-the-Future whois', a free service enabling large-scale historic IP address attribution using daily CAIDA Routeviews data, filling a gap in existing tools for researchers working with past network datasets.

Contribution

The paper presents a novel service for historic bulk IP address attribution, including implementation details and evaluation, addressing a key gap in network measurement research.

Findings

Provides daily granularity historic IP attribution

Enables large-scale analysis of past network data

Open-source implementation for community use

Abstract

Researchers and practitioners often face the issue of having to attribute an IP address to an organization. For current data this is comparably easy, using services like whois or other databases. Similarly, for historic data, several entities like the RIPE NCC provide websites that provide access to historic records. For large-scale network measurement work, though, researchers often have to attribute millions of addresses. For current data, Team Cymru provides a bulk whois service which allows bulk address attribution. However, at the time of writing, there is no service available that allows historic bulk attribution of IP addresses. Hence, in this paper, we introduce and evaluate our 'Back-to-the-Future whois' service, allowing historic bulk attribution of IP addresses on a daily granularity based on CAIDA Routeviews aggregates. We provide this service to the community for free, and also share our implementation so researchers can run instances themselves.