Observed structure of addresses in IP traffic

Eddie Kohler, Jinyang Li, Vern Paxson, Scott Shenker

Research output: Contribution to journalArticlepeer-review


We investigate the structure of addresses contained in IPv4 traffic - specifically, the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. Several example address structures are well modeled by multifractal Cantor-like sets with two parameters. This model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful "fingerprints" of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these fingerprints.

Original languageEnglish (US)
Pages (from-to)1207-1218
Number of pages12
JournalIEEE/ACM Transactions on Networking
Issue number6
StatePublished - Dec 2006


  • Address space
  • Address structures
  • Multifractals
  • Network measurement

ASJC Scopus subject areas

  • Software
  • Computer Science Applications
  • Computer Networks and Communications
  • Electrical and Electronic Engineering


Dive into the research topics of 'Observed structure of addresses in IP traffic'. Together they form a unique fingerprint.

Cite this