Do You See Me Now? Sparsity in Passive Observations of Address Liveness (extended)

Do You See Me Now? Sparsity in Passive Observations of Address Liveness (extended)

Mirkovic, Jelena and Bartlett, Genevieve and Heidemann, John and Shi, Hao and Deng, Xiyue
USC/Information Sciences Institute

Jelena Mirkovic, Genevieve Bartlett, John Heidemann, Hao Shi and Xiyue Deng 2016. Do You See Me Now? Sparsity in Passive Observations of Address Liveness (extended). Technical Report ISI-TR-2016-710. USC/Information Sciences Institute.

Abstract

Full allocation of IPv4 addresses has prompted interest in measuring address \emphliveness, first with active probing, and recently with the addition of passive observation. While prior work has shown dramatic increases in coverage, this paper explores \emphwhat factors affect contributions of passive observers to visibility. While all passive monitors are \emphsparse, seeing only a part of the Internet, we seek to understand how different types of sparsity impact observation quality: the \emphinterests of external hosts and the hosts within the observed network, the \emphtemporal limitations on the observation duration, and \emphcoverage challenges to observe all traffic for a given target or a given vantage point. We study sparsity with \emphinverted analysis, a new approach where we use passive monitors at four sites to infer what monitors would see at \emphall sites exchanging traffic with those four. We show that visibility provided by monitors is heavy-tailed—interest sparsity means popular monitors see a great deal, while 99% see very little. We find that traffic is bipartite, with visibility much stronger between client-networks and server-networks than within each group. Finally, we find that popular monitors are robust to temporal and coverage sparsity, but they greatly reduce power of monitors that start with low visibility.

Reference

@techreport{Mirkovic16a,
  author = {Mirkovic, Jelena and Bartlett, Genevieve and Heidemann, John and Shi, Hao and Deng, Xiyue},
  title = {Do You See Me Now? Sparsity in Passive
                    Observations of Address Liveness (extended)},
  institution = {USC/Information Sciences Institute},
  year = {2016},
  sortdate = {2016-07-27},
  number = {ISI-TR-2016-710},
  project = {ant, lacrend, lander, retrofuture},
  jsubject = {topology_modeling},
  month = jul,
  location = {johnh: pafile},
  keywords = {passive observation, internet census},
  url = {http://www.isi.edu/%7ejohnh/PAPERS/Mirkovic16a.html},
  pdfurl = {http://www.isi.edu/%7ejohnh/PAPERS/Mirkovic16a.pdf},
  myorganization = {USC/Information Sciences Institute},
  copyrightholder = {authors}
}