Observed Structure of Addresses in IP Traffic

This paper investigates the structure of addresses contained in IP traffic. Specifically, we analyze the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics may have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. We find that address structures are well modeled by a multifractal Cantor dust with two parameters. The model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful "fingerprints" of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these "fingerprints".