Ebb and Flow: Implications of ISP Address Dynamics

Baltra, Guillermo and Song, Xiao and Heidemann, John
USC/Information Sciences Institute


Guillermo Baltra, Xiao Song and John Heidemann 2024. Ebb and Flow: Implications of ISP Address Dynamics. Proceedings of the Passive and Active Measurement Workshop (Virtual Location, Mar. 2024). [PDF] [Dataset]


Address dynamics are changes in IP address occupation as users come and go, ISPs renumber them for privacy or for routing maintenance. Address dynamics affect address reputation services, IP geolocation, network measurement, and outage detection, with implications of Internet governance, e-commerce, and science. While prior work has identified diurnal trends in address use, we show the effectiveness of Multi-Seasonal-Trend using Loess decomposition to identify both daily and weekly trends. We use ISP-wide dynamics to develop IAS, a new algorithm that is the first to automatically detect ISP maintenance events that move users in the address space. We show that 20% of such events result in /24 IPv4 address blocks that become unused for days or more, and correcting nearly 41k false outages per quarter. Our analysis provides a new understanding about ISP address use: while only about 2.8% of ASes (1,730) are diurnal, some diurnal ASes show more than 20% changes each day. It also shows greater fragmentation in IPv4 address use compared to IPv6.


  author = {Baltra, Guillermo and Song, Xiao and Heidemann, John},
  title = {Ebb and Flow: Implications of {ISP} Address Dynamics},
  booktitle = {Proceedings of the  Passive and Active Measurement Workshop},
  year = {2024},
  sortdate = {2024-03-11},
  project = {ant, eieio, minceq, internetmap},
  month = mar,
  address = {Virtual Location},
  publisher = {Springer},
  jlocation = {johnh: pafile},
  keywords = {trinocular, outages, ISP address use},
  url = {https://ant.isi.edu/%7ejohnh/PAPERS/Baltra24a.html},
  pdfurl = {https://ant.isi.edu/%7ejohnh/PAPERS/Baltra24a.pdf},
  blogurl = {https://ant.isi.edu/blog/?p=2043},
  dataseturl = {https://ant.isi.edu/datasets/outage/index.html},
  myorganization = {USC/Information Sciences Institute},
  copyrightholder = {Springer}