Print Email Facebook Twitter How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation Title How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation Author Moreira Moura, G.C. Ganan, C.H.G. Lone, Q.B. Poursaied, P. Asghari, H. Van Eeten, M.J.G. Faculty Technology, Policy and Management Department Multi Actor Systems Date 2015-05-20 Abstract IP address counts are typically used as a surrogate metric for the number of hosts in a network, as in the case of ISP rankings based on botnet infected addresses. However, due to effects of dynamic IP address allocation, such counts tend to overestimate the number of hosts, sometimes by an order of magnitude. In the literature, the rate at which hosts change IP addresses is referred to as DHCP churn. Churn rates vary significantly within and among ISP networks, and such variation poses a challenge to any research that relies upon IP addresses as a metric. We present the first attempt towards estimating ISP and Internet-wide DHCP churn rates, in order to better understand the relation between IP addresses and hosts, as well as allow us to correct data relying on IP addresses as a surrogate metric. We propose an scalable active measurement methodology and then validate it using ground truth data from a medium-sized ISP. Next, we build a statistical model to estimate DHCP churn rates and validate against the ground truth data of the same ISP, estimating correctly 72.3% of DHCP churn rates. Finally, we apply our measurement methodology to four major ISPs, triangulate the results to another Internet census, and discuss the next steps to more precisely estimate DHCP churn rates. To reference this document use: http://resolver.tudelft.nl/uuid:a41254a9-812a-4044-8b43-14035499dfba Publisher IFIP ISBN 9783901882685 Source Networking 2015, 14th International Conference on Networking, 20–22 May 2015, Toulouse, France Part of collection Institutional Repository Document type conference paper Rights © 2015 IFIP. This is the authors version of the work. It is posted here by permission of IFIP for your personal use. Not for redistribution. The definitive version was published in Proceedings IFIP Networking Conference, 2015. Files PDF ifip2015-TUD.pdf 1.66 MB Close viewer /islandora/object/uuid:a41254a9-812a-4044-8b43-14035499dfba/datastream/OBJ/view