Assessing Co-Locality of IP Blocks. Gharaibeh, M., Zhang, H., Papadopoulos, C., & Heidemann, J. Technical Report CS-15-103, Colorado State University Department of Computer Science , November, 2015.
Assessing Co-Locality of IP Blocks [link]Paper  abstract   bibtex   
Many IP Geolocation services and applications assume that all IP addresses with the same /24 IPv4 prefix (a \emph/24 block) are in the same location. For blocks that contain addresses in very different locations (such blocks identifying network backbones), this assumption can result in large geolocation error. This paper evaluates this assumption using a large dataset of 1.41M /24 blocks extracted from a delay measurements dataset for the entire responsive IPv4 address space. We use hierarchal clustering to find clusters of IP addresses with similar observed delay measurements within /24 blocks. Blocks with multiple clusters often span different geographic locations. We evaluate this claim against two ground-truth datasets, confirming that 93% of identified multi-cluster blocks are true positives with multiple locations, while only 13% of blocks identified as single-cluster appear to be multi-location in ground truth. Applying the clustering process to the whole dataset suggests that about 17% (247K) of blocks are likely multi-location.
@TechReport{Gharaibeh15a,
	author = 	"Manaf Gharaibeh and Han Zhang and Christos Papadopoulos and John Heidemann",
	title = 	"Assessing Co-Locality of {IP} Blocks",
	institution = 	"Colorado State University " # " Department of Computer Science ",
	year = 		2015,
	number = 	"CS-15-103",
	month = 	nov,
	sortdate = "2015-11-01",
	jlocation = 	"johnh: pafile",
	keywords = 	"IP geolocation",
	url =		"https://ant.isi.edu/%7ejohnh/PAPERS/Gharaibeh15a.html",
	pdfurl =		"https://ant.isi.edu/%7ejohnh/PAPERS/Gharaibeh15a.pdf",
	myorganization =	"USC/Information Sciences Institute",
	copyrightholder = "authors",
	project = "ant, lacrend, retrofuture",
	abstract = "Many IP Geolocation services and applications assume that all IP addresses with
the same /24 IPv4 prefix (a \emph{/24 block}) are in the same location. For
blocks that contain addresses in very different locations (such blocks
identifying network backbones), this assumption can result in large geolocation
error. This paper evaluates this assumption using a large dataset of 1.41M /24
blocks extracted from a delay measurements dataset for the entire responsive
IPv4 address space.  We use hierarchal clustering to find clusters of IP
addresses with similar observed delay measurements within /24 blocks.  Blocks
with multiple clusters often span different geographic locations. We evaluate
this claim against two ground-truth datasets, confirming that 93\% of
identified multi-cluster blocks are true positives with multiple locations,
while only 13\% of blocks identified as single-cluster appear to be
multi-location in ground truth. Applying the clustering process to the whole
dataset suggests that about 17\% (247K) of blocks are likely multi-location."
,}

Downloads: 0