A Global Inference and Assessment of Large Shared IP Addresses

The number of clients and users behind an IP address can differ by orders of magnitude, owing to large shared IPs such as VPNs, proxies, and Carrier-Grade NAT (CGN) gateways. However, limitations on visibility, the absence of Internet-wide data, and the dynamic nature of IP allocations make it difficult to disambiguate multi-user IPs (M-IPs) and their impact on service provision. In this paper we devise an inference technique to detect M-IPs. We train a classifier by annotating data from public sources with features extracted from a global CDN request log. To demonstrate reproducibility, we build a parallel model using public M-Lab data and achieve comparable accuracy with different features. An unanticipated result was the dominance of /24 feature importance over individual IPs. Using the CDN logs, we then evaluate implications of CGNs along multiple dimensions including user impact, relationship with IPv6 networks, and regional distributions. Our results reinforce various intuition, and potentially challenge some assumptions.