MAPPING -- Measuring And Practically Predicting INternet Growth

Measuring and predicting growth in Internet addressing, routing complexity and energy usage

IPv4 Internet Map

Overview

One aspect of the MAPPING project is to estimate the fraction of used IPv4 addresses and the current usage patterns. The IPv4 Internet Map visualises the address usage. The map shows which parts of the Internet are more heavily used and which parts are more lightly used, or are not used at all. The map also shows different patterns, for example in some /8 prefixes nearly all /24 subnets are lightly used whereas in other /8 prefixes some /24 subnets are heavily used while other are not used at all.

The map is based on IPv4 address usage information collected from various sources. The map also shows the unusable space, unallocated space and unrouted space. The contents of the map are explained in more detail here.

Note that we collected IP addresses over the last 2--3 years, and our map shows the IPv4 addresses that were used during this time period. The map is not an instantaneous snapshot of the Internet, which is impossible to obtain. Since in many parts of the Internet IPv4 addresses are assigned dynamically, a single hosts could have used multiple addresses over time. However, this is counter-balanced by the fact that we were not able to observe all existing hosts given our data sources.

Also, note that the map visualises the used IPv4 addresses and not the hosts connected to the Internet. Multiple hosts may share a single public IPv4 address if they are behind a Network Address Translator (NAT) or may be behind some kind of proxy (depending on the data source proxies may exist).

IPv4 Internet Map

The following figure shows the IPv4 Internet Map. We can see that a large part of the old /8 allocations assigned to corporations or US military are unused (top left quadrant). Also, a large part of the old class B space (bottom right quadrant) is only lightly used. The rest of the allocated space is more or less well used. (Note that 214.0.0.0/8 and 215.0.0.0/8 are also assigned to US military.)

Highlighting the unrouted space, we can see that a large part of the unused space is actually not publicly routed. This means either this space is unused or used in networks separated from the rest of the Internet (likely for military or other security-conscious organisations).

If you want to see the changes over time, there is now a time series of IPv4 maps starting in December 2011.

IPv4 Internet Map Explained

Used IPv4 addresses

We group all observed IPv4 addresses into /24 subnets (by setting the last octet to 0) and count how many addresses we observed for each of these /24 subnets. The percentage of observed addresses is indicated by a scale that ranges from light green (>0--20%) to dark green (80--100%). Any /24 subnets where we have not seen any used addresses are white. Each /24 subnet is represented as a single pixel in the full resolution map. The following figure shows the legend.

Unusable, unallocated, unrouted space

A number of address ranges cannot be used, because they serve special purposes. This unusable space is indicated by grey colour. The following table lists the unusable space.

Range	Address type
0.0.0.0/8	Reserved
10.0.0.0/8	Private addresses
127.0.0.0/8	Loopback addresses
172.168.0.0/12	Private addresses
192.168.0.0/16	Private addresses
224.0.0.0/8--239.0.0.0/8	Multicast addresses
240.0.0.0/8--255.0.0.0/8	Reserved

The Regional Internet Registrars (RIRs) assign the Internet's address space. They keep a list of all allocations, the so-called delegated data. We use Geoff Huston's aggregated delegated data (from here) to plot the unallocated space in blue colour (see figure below).

Not all allocated address space is actually routed. The Route Views Project publishes Border Gateway Protocol (BGP) routing information. We use this information to plot the unrouted space in lighter blue colour.

The following figure shows the legend for unusable, unallocated, and unrouted space.

Layout

The layout of the map is based on Randall Munroe's famous xkcd Map of the Internet. The positions of all /24 subnets are based on a continuous fractal space-filling curve first described by the German mathematician David Hilbert (Hilbert curve). The advantage of a Hilbert curve is that is preserves locality, meaning contiguous /24 subnets are positioned closely together in the 2D space. The same is true for any larger prefixes, e.g. all /8 prefixes are squares. The following figure shows how the Hilbert curve for the first 16 /8 prefixes.

The left half of the map is the old class A space. The top left quadrant shows the /8s directly allocated to corporations and government agencies before the RIRs were tasked with the assignment. The bottom right quadrant is the old class B space. The top right quadrant contains the old class C space and also the multicast and experimental address ranges.

Numbering of /8 prefixes

All /8 prefixes (0--255) are numbered on the map. The numbers are coloured based on the RIRs that mainly allocated IPv4 addresses from these prefixes (or for old /8 prefixes we assume the RIRs that now would assign them given the current owners country). Some /8 prefixes are hard to associate with a particular RIR, as portions have been allocated by different RIRs, and we put them into the "several" category (black). Also, the numbers of all /8 prefixes that cannot be allocated, such as 10.0.0.0/8 (private), are coloured black. The following figure shows the RIR colour coding legend.

Data Sources

The IPv4 usage data was collected from a number of sources. The following table lists the sources, collection time periods and number of unique IPv4 addresses observed. Overall, for all datasets combined, we observed 714 million unique used IPv4 addresses until March 2013 (569 million addresses until August 2012).

Dataset	Start time	Aug 2012 IPv4s [M]	Mar 2013 IPv4s [M]
WIKI	Jan 2011	8.1	12.4
SPAM	May 2012	12.6	23.3
MLAB	May 2012	NA	57.2
WEB	Mar 2011	71.6	122.4
GAME	Jan 2011	125.4	291.4
SWIN	Jan 2011	155.7	190.9
PING	Sep 2011	439.3	524.7
Total	Jan 2011	569	714

The PING data is from multiple "ping census'" we carried out repeatedly since September 2011. Our probe machine actively probes the whole IPv4 Internet (all allocated addresses at the time). It sends an ICMP echo request and a TCP SYN (port 80) to each IP address and records the response. We consider all IP addresses as used from which we receive a positive response (either an ICMP echo reply or a TCP SYN/ACK).

The WIKI data consists of IP addresses from the edit history for all Wikipedia pages. For edits that were not made by a registered user, Wikipedia logs the IP addresses of the client from which the edit was made.

The SPAM dataset consists of IP addresses from the spam list collected by the German iX magazine.

The MLAB dataset consists of IP addresses from clients tested by M-Lab tools.

The WEB data consist of IP addresses collected by our IPv6 capability testing servers (see our IMC 2012 paper here).

The GAME data is IP addresses collected from a major online game system. Each time a game client logs into their system a database entry is created that contains the client's IP address.

The SWIN data is IP addresses extracted from NetFlow records generated at Swinburne University's access router for all traffic flows that pass through the router.

Downloads

IPv4 Internet Map March 2014 [pdf] [png]
IPv4 Internet Map March 2014 without unrouted space [pdf] [png]

IPv4 Internet Map March 2013 [pdf] [png]
IPv4 Internet Map March 2013 without unrouted space [pdf] [png]

IPv4 Internet Map August 2012 [pdf] [png]
IPv4 Internet Map August 2012 without unrouted space [pdf] [png]

If you would like to get a high-resolution postscript version of the map please contact us.

Future work

We are currently working on statistical methods to estimate the used but "invisible" IPv4 addresses. In the future we will update the map based on new observed data, as well as the estimated unseen addresses.

We will also create other maps to visualise different aspects of the Internet, for example visualise statically vs. dynamically allocated space, or visualise IPv6-capable vs. non-IPv6-capable space.

Links

Other Internet maps:

xkcd Map of the Internet (2006)

ANT Censuses of the Internet Address Space

Internet Census 2012

Contact

If you would like to contribute to the project (e.g. by giving us access to IPv4 address data), or have any suggestions or comments please contact Sebastian Zander (szander@swin.edu.au).

This project has been made possible in part by grants from APNIC for a project titled "Exploring the Utilisation of IPv4 Address Space and Size of the NATed IPv4 Internet" and an ARC linkage grant with APNIC as partner organisation for a project titled "Tools and models for measuring and predicting growth in internet addressing and routing complexity" (project LP110100240). The research has also been supported by Australian Research Council grant FT0991594.