On the benefits of using a large IXP as an internet vantage point

Abstract

In the context of measuring the Internet, a long-standing question has been whether there exist well-localized physical entities in today's network where traffic from a representative cross-section of the constituents of the Internet can be observed at a fine-enough granularity to paint an accurate and informative picture of how these constituents shape and impact much of the structure and evolution of today's Internet and the actual traffic it carries.In this paper, we first answer this question in the affirmative by mining 17 weeks of continuous sFlow data from one of the largest European IXPs. Examining these weekly snapshots, we discover a vantage point with excellent visibility into the Internet, seeing week-in and week-out traffic from all 42K+ routed ASes, almost all 450K+ routed prefixes, from close to 1.5M servers, and around a quarter billion IPs from all around the globe. Second, to show the potential of such vantage points, we analyze the server-related portion of the traffic at this IXP, identify the server IPs and cluster them according to the organizations responsible for delivering the content. In the process, we observe a clear trend among many of the critical Internet players towards network heterogenization; that is, either hosting servers of third-party networks in their own infrastructures or pursuing massive deployments of their own servers in strategically chosen third-party networks. While the latter is a wellknown business strategy of companies such as Akamai, Google, and Netflix, we show in this paper the extent of network heterogenization in today's Internet and illustrate how it enriches the traditional, largely traffic-agnostic AS-level view of the Internet. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. IMC '13, October 23-25, 2013 Categories and Subject Descriptors AcknowledgmentsThis work would not have been possible without the help, engagement, and commitment of Walter Willinger.We want to express our gratitude towards the IXP for their generous cooperation and support. Moreover, we thank the anonymous reviewers for their useful feedback.

Something from Nothing (There): Collecting Global IPv6 Datasets from DNS

“…However, unfortunately for the common researcher, these studies have-so far-been dominated by the analysis of large, restricted, and proprietary datasets. For instance, the wellknown content delivery network (CDN) dataset used for most contemporary IPv6 analyses [15,8], Internet exchange point (IXP) datasets, which were used regularly by some other research groups [3,9], or, slightly less restrictive, the Farsight DNS recursor dataset [21]. Although public datasets do exist, they are traceroute-based datasets from various sources, including the RIPE Atlas project [17], which are limited due to their nature: they are biased towards addresses of networking equipment, and, in turn, bear their own set of problems for meaningful analyses.…”

Exploring EDNS-client-subnet adopters in your free time

“…This becomes increasingly important as many CDNs continuously deploy servers at the network edges or within ISPs. Thus, one can not infer the operator of a cache by simply looking at the IP address or AS number [15]. As we show above, RIPE and RV public prefix sets uncover by far more IPs than the other prefix sets.…”

The Amplification Threat Posed by PubliclyReachable BACnet Devices

“…Our first vantage point at a large European IXP allows us to obtain an authentic view of BACnet traffic in the Internet [6]. The IXP is located in central Europe and interconnects about 700 ASes which exchange more than 5 Tbit/s at peak times.…”