{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T04:30:42Z","timestamp":1773117042262,"version":"3.50.1"},"reference-count":25,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2013,12,31]],"date-time":"2013-12-31T00:00:00Z","timestamp":1388448000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGCOMM Comput. Commun. Rev."],"published-print":{"date-parts":[[2013,12,31]]},"abstract":"<jats:p>One challenge in understanding the evolution of Internet infrastructure is the lack of systematic mechanisms for monitoring the extent to which allocated IP addresses are actually used. Address utilization has been monitored via actively scanning the entire IPv4 address space. We evaluate the potential to leverage passive network traffic measurements in addition to or instead of active probing. Passive traffic measurements introduce no network traffic overhead, do not rely on unfiltered responses to probing, and could potentially apply to IPv6 as well. We investigate two challenges in using passive traffic for address utilization inference: the limited visibility of a single observation point; and the presence of spoofed IP addresses in packets that can distort results by implying faked addresses are active. We propose a methodology for removing such spoofed traffic on both darknets and live networks, which yields results comparable to inferences made from active probing. Our preliminary analysis reveals a number of promising findings, including novel insight into the usage of the IPv4 address space that would expand with additional vantage points.<\/jats:p>","DOI":"10.1145\/2567561.2567568","type":"journal-article","created":{"date-parts":[[2014,1,21]],"date-time":"2014-01-21T13:31:00Z","timestamp":1390311060000},"page":"42-49","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":49,"title":["Estimating internet address space usage through passive measurements"],"prefix":"10.1145","volume":"44","author":[{"given":"Alberto","family":"Dainotti","sequence":"first","affiliation":[{"name":"CAIDA, UC San Diego, La Jolla, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Karyn","family":"Benson","sequence":"additional","affiliation":[{"name":"CAIDA, UC San Diego, La Jolla, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alistair","family":"King","sequence":"additional","affiliation":[{"name":"CAIDA, UC San Diego, La Jolla, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"kc","family":"claffy","sequence":"additional","affiliation":[{"name":"CAIDA, UC San Diego, La Jolla, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michael","family":"Kallitsis","sequence":"additional","affiliation":[{"name":"Merit Network, Inc., Ann Arbor, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Eduard","family":"Glatz","sequence":"additional","affiliation":[{"name":"ETH Zurich, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xenofontas","family":"Dimitropoulos","sequence":"additional","affiliation":[{"name":"ETH Zurich, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2013,12,31]]},"reference":[{"key":"e_1_2_2_1_1","unstructured":"http:\/\/seclists.org\/nanog\/2009\/Feb\/2.  http:\/\/seclists.org\/nanog\/2009\/Feb\/2."},{"key":"e_1_2_2_2_1","unstructured":"A. Dainotti A. King. CAIDA Blog: Carna botnet scans confirmed. http:\/\/blog.caida.org\/best_available_data\/2013\/05\/13\/carna-botnet-scans\/.  A. Dainotti A. King. CAIDA Blog: Carna botnet scans confirmed. http:\/\/blog.caida.org\/best_available_data\/2013\/05\/13\/carna-botnet-scans\/."},{"key":"e_1_2_2_3_1","unstructured":"Advanced Network Technology Center University of Oregon. Route Views Project. http:\/\/www.routeviews.org\/.  Advanced Network Technology Center University of Oregon. Route Views Project. http:\/\/www.routeviews.org\/."},{"key":"e_1_2_2_4_1","volume-title":"Traffic Monitoring and Analysis Workshop (TMA)","author":"Benson K.","year":"2013","unstructured":"K. Benson , A. Dainotti , k. claffy, and E. Aben . Gaining Insight into AS-level Outages through Analysis of Internet Background Radiation . In Traffic Monitoring and Analysis Workshop (TMA) , Apr 2013 . K. Benson, A. Dainotti, k. claffy, and E. Aben. Gaining Insight into AS-level Outages through Analysis of Internet Background Radiation. In Traffic Monitoring and Analysis Workshop (TMA), Apr 2013."},{"key":"e_1_2_2_5_1","volume-title":"USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet, SRUTI'05","author":"Beverly R.","unstructured":"R. Beverly and S. Bauer . The spoofer project: inferring the extent of source address filtering on the internet . In USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet, SRUTI'05 . R. Beverly and S. Bauer. The spoofer project: inferring the extent of source address filtering on the internet. In USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet, SRUTI'05."},{"key":"e_1_2_2_7_1","unstructured":"CAIDA. Supplemental data: Estimating Internet address space usage through passive measurements. http:\/\/www.caida.org\/publications\/papers\/2013\/passive_ip_space_usage_estimation\/supplemental\/ 2013.  CAIDA. Supplemental data: Estimating Internet address space usage through passive measurements. http:\/\/www.caida.org\/publications\/papers\/2013\/passive_ip_space_usage_estimation\/supplemental\/ 2013."},{"key":"e_1_2_2_8_1","unstructured":"E. Chien. Downadup: Attempts at Smart Network Scanning. http:\/\/www.symantec.com\/connect\/blogs\/downadup-attempts-smart-network-scanning 2009.  E. Chien. Downadup: Attempts at Smart Network Scanning. http:\/\/www.symantec.com\/connect\/blogs\/downadup-attempts-smart-network-scanning 2009."},{"key":"e_1_2_2_9_1","volume-title":"Proceedings of the 22nd USENIX Security Symposium","author":"Durumeric Z.","year":"2013","unstructured":"Z. Durumeric , E. Wustrow , and J. A. Halderman . ZMap: Fast Internet-wide scanning and its security applications . In Proceedings of the 22nd USENIX Security Symposium , 2013 . Z. Durumeric, E. Wustrow, and J. A. Halderman. ZMap: Fast Internet-wide scanning and its security applications. In Proceedings of the 22nd USENIX Security Symposium, 2013."},{"key":"e_1_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1452520.1452542"},{"key":"e_1_2_2_11_1","volume-title":"Spiegel Online","author":"Horchert J.","year":"2013","unstructured":"J. Horchert and C. St\u00f6cker . Mapping the internet: A hacker's secret internet census . Spiegel Online , March 2013 . J. Horchert and C. St\u00f6cker. Mapping the internet: A hacker's secret internet census. Spiegel Online, March 2013."},{"key":"e_1_2_2_12_1","unstructured":"Information of Sciences Institute University of Southern California. LANDER project:Internet address census it49c-20120731. http:\/\/www.isi.edu\/ant\/traces\/internet_address_census_it49c-20120731.README.txt 2012.  Information of Sciences Institute University of Southern California. LANDER project:Internet address census it49c-20120731. http:\/\/www.isi.edu\/ant\/traces\/internet_address_census_it49c-20120731.README.txt 2012."},{"key":"e_1_2_2_13_1","unstructured":"Information of Sciences Institute USC. Internet Address Survey Binary Format. http:\/\/www.isi.edu\/ant\/traces\/topology\/address_surveys\/binformat_description.html 2012.  Information of Sciences Institute USC. Internet Address Survey Binary Format. http:\/\/www.isi.edu\/ant\/traces\/topology\/address_surveys\/binformat_description.html 2012."},{"key":"e_1_2_2_14_1","unstructured":"Information of Sciences Institute USC. ANT Census of the Internet Address Space - browsable map. http:\/\/www.isi.edu\/ant\/address\/browse\/index.html 2013.  Information of Sciences Institute USC. ANT Census of the Internet Address Space - browsable map. http:\/\/www.isi.edu\/ant\/address\/browse\/index.html 2013."},{"key":"e_1_2_2_15_1","unstructured":"Insecure.Com LLC. Nmap Security Scanner. http:\/\/nmap.org.  Insecure.Com LLC. Nmap Security Scanner. http:\/\/nmap.org."},{"key":"e_1_2_2_16_1","volume-title":"Google Inc.","author":"Langley A.","year":"2008","unstructured":"A. Langley . Probing the viability of TCP extensions. Technical report , Google Inc. , Sep 2008 . A. Langley. Probing the viability of TCP extensions. Technical report, Google Inc., Sep 2008."},{"key":"e_1_2_2_17_1","unstructured":"Merit Network Inc. Merit Darknet IPv4. http:\/\/software.merit.edu\/darknet\/.  Merit Network Inc. Merit Darknet IPv4. http:\/\/software.merit.edu\/darknet\/."},{"key":"e_1_2_2_18_1","volume-title":"MAP of the INTERNET","author":"Munroe R.","year":"2006","unstructured":"R. Munroe . xkcd : MAP of the INTERNET 2006 . http:\/\/blog.xkcd.com\/2006\/12\/11\/the-map-of-the-internet\/. R. Munroe. xkcd: MAP of the INTERNET 2006. http:\/\/blog.xkcd.com\/2006\/12\/11\/the-map-of-the-internet\/."},{"key":"e_1_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028794"},{"key":"e_1_2_2_20_1","volume-title":"http:\/\/www.binbert.com\/blog\/2009\/12\/default-time-to-live-ttl-values\/","author":"Sebastian A.","year":"2009","unstructured":"A. Sebastian . Default Time To Live (TTL) values. http:\/\/www.binbert.com\/blog\/2009\/12\/default-time-to-live-ttl-values\/ , 2009 . A. Sebastian. Default Time To Live (TTL) values. http:\/\/www.binbert.com\/blog\/2009\/12\/default-time-to-live-ttl-values\/, 2009."},{"key":"e_1_2_2_21_1","first-page":"10","author":"Spires A. N.","year":"2003","unstructured":"A. N. Shannon V. Spires . Exhaustive search system and method using space-filling curves. Patent , 10 2003 . US 6636847. A. N. Shannon V. Spires. Exhaustive search system and method using space-filling curves. Patent, 10 2003. US 6636847.","journal-title":"Patent"},{"key":"e_1_2_2_22_1","unstructured":"SWITCH. Swiss Tele Communication System for Higher Education. http:\/\/www.switch.ch\/.  SWITCH. Swiss Tele Communication System for Higher Education. http:\/\/www.switch.ch\/."},{"key":"e_1_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2003.1194882"},{"key":"e_1_2_2_24_1","unstructured":"University of California San Diego. The UCSD Network Telescope. http:\/\/www.caida.org\/projects\/network_telescope\/.  University of California San Diego. The UCSD Network Telescope. http:\/\/www.caida.org\/projects\/network_telescope\/."},{"key":"e_1_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879149"},{"key":"e_1_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/LCNW.2013.6758545"}],"container-title":["ACM SIGCOMM Computer Communication Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2567561.2567568","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2567561.2567568","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T07:34:38Z","timestamp":1750232078000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2567561.2567568"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,12,31]]},"references-count":25,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2013,12,31]]}},"alternative-id":["10.1145\/2567561.2567568"],"URL":"https:\/\/doi.org\/10.1145\/2567561.2567568","relation":{},"ISSN":["0146-4833"],"issn-type":[{"value":"0146-4833","type":"print"}],"subject":[],"published":{"date-parts":[[2013,12,31]]},"assertion":[{"value":"2013-12-31","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}