大规模共享IP地址的检测与特征分析
Detecting and Characterizing Massively Shared IP Addresses
浏览论文内容
中文总结 AI 辅助
本研究借助大型CDN数据，基于流量昼夜模式检测并分析大规模共享IP，发现其占IPv4流量超40%、集中于不到2%的活跃IP，且IPv6中较少、比例随时间上升，为IP共享提供全球视角
中文摘要 AI 辅助
IP地址因多种原因常被设备和用户共享，包括网络地址转换（NAT）和代理。这些技术的运行规模各不相同，从家庭中在设备间共享一个IP的住宅NAT，到在单个IP上共享成百上千用户的大规模运营商级NAT。大规模IP共享的情况具有独特性，因为它们对基于IP的机制（如归因、黑名单和速率限制）有重大影响，处理不当的后果会影响大量终端用户和组织。在本研究中，我们检测并分析大规模共享的IP地址，将其命名为“大规模共享IP”。利用流量形态的昼夜模式，我们借助大型内容分发网络（CDN）的数据对这些IP进行全球特征分析。我们总体发现，大规模IP共享占IPv4流量的很大一部分，集中在一小部分地址空间中，超过40%的总流量来自不到2%的活跃IP地址。我们观察到不同地区部署的模式存在差异，一些较小国家的大规模共享流量比例特别高。相比之下，在IPv6中，我们发现大规模共享地址少得多，不过移动运营商中存在一些令人惊讶的例外情况。我们还结合其他网络特征对这些地址进行背景分析，包括识别蜂窝连接和双栈能力，并在云网络托管的代理服务中发现了若干大规模共享IP的实例。最后，我们发现大规模共享流量的比例随时间在上升，预示着未来对这些技术的依赖会增加。本研究明确了IP共享的现状，提供了独特的全球广泛视角。
英文摘要
IP addresses are commonly shared across devices and users for a variety of reasons, including NAT and proxies. These technologies operate at different scales, from residential NATs that share an IP address across devices in a home to large-scale Carrier Grade NATs that share hundreds or thousands of users on a single IP. Cases of large-scale IP sharing are distinct as they have significant implications for IP-based mechanisms such as attribution, blocklisting, and rate-limiting, where the consequences of mishandling affect a large quantity of end-users and organizations. In this work, we detect and characterize IP addresses shared at large scales, which we coin massively shared. Leveraging diurnal patterns in traffic shape, we use data from a large CDN to characterize these IPs globally. We broadly find that massive IP sharing is responsible for a large fraction of IPv4 traffic, concentrated in a small fraction of address space, with over 40% of total traffic coming from less than 2% of active IP addresses. We observe distinct patterns in deployment geographically, with particularly high rates of massively shared traffic from some smaller countries. Comparatively, in IPv6, we find far fewer massively shared addresses with some surprising exceptions among mobile providers. We additionally contextualize these addresses by other network characteristics, including identifying cellular connectivity and dual-stack capabilities, and identifying several instances of massively shared IPs in proxy services hosted on cloud networks. Finally, we find that rates of massively shared traffic are increasing over time, predicting future reliance on these technologies. Our work contextualizes the state of IP sharing, providing a uniquely broad perspective globally.
