using ripe atlas for geolocating ip infrastructure

The vast majority of studies on IP geolocation focuses on localizing the end-users, and little attention has been devoted to localizing the elements of the Internet infrastructure, i.e., the routers and servers that make the Internet work. In this paper, we study the maximum theoretical accuracy that can be achieved by a geolocation approach aimed at geolocating the Internet infrastructure. In particular, we study the effects on localization accuracy produced by the position of landmarks and by the strategy followed for their enrollment. We compare two main approaches: the first is more centralized and controlled, and uses well-connected machines belonging to the infrastructure as landmarks; the second is more distributed and scalable and is based on landmarks positioned at the edge of the network. The study is based on an extensive set of measurements collected using the RIPE Atlas platform. The results show that the uniform and widespread diffusion of landmarks can be as important as their measurement accuracy. The study is carried out at both the worldwide and regional scale, including regions that were scarcely observed in the past. The results highlight that the geographical characteristics of the Internet paths are dependent on the considered region, thus suggesting the use of specifically calibrated models. Finally, the study shows that geolocating IP infrastructure with active measurements is feasible in terms of precision and scalability of the overall system

Characterizing User-to-User Connectivity with RIPE Atlas

Characterizing the interconnectivity of networks at a country level is an interesting but non-trivial task. The IXP Country Jedi is an existing prototype that uses RIPE Atlas probes in order to explore interconnectivity at a country level, taking into account all Autonomous Systems (AS) where RIPE Atlas probes are deployed. In this work, we build upon this basis and specifically focus on "eyeball" networks, i.e. the user-facing networks with the largest user populations in any given country, and explore to what extent we can provide insights on their interconnectivity. In particular, with a focused user-to-user (and/or user-to-content) version of the IXP Country Jedi we work towards meaningful statistics and comparisons between countries/economies. This is something that a general-purpose probe-to-probe version is not able to capture. We present our preliminary work on the estimation of RIPE Atlas coverage in eyeball networks, as well as an approach to measure and visualize user interconnectivity with our Eyeball Jedi tool.Comment: In Proceedings of the Applied Networking Research Workshop (ANRW '17

Passport: Enabling Accurate Country-Level Router Geolocation using Inaccurate Sources

When does Internet traffic cross international borders? This question has major geopolitical, legal and social implications and is surprisingly difficult to answer. A critical stumbling block is a dearth of tools that accurately map routers traversed by Internet traffic to the countries in which they are located. This paper presents Passport: a new approach for efficient, accurate country-level router geolocation and a system that implements it. Passport provides location predictions with limited active measurements, using machine learning to combine information from IP geolocation databases, router hostnames, whois records, and ping measurements. We show that Passport substantially outperforms existing techniques, and identify cases where paths traverse countries with implications for security, privacy, and performance

Passport: enabling accurate country-level router geolocation using inaccurate sources

When does Internet traffic cross international borders? This question has major geopolitical, legal and social implications and is surprisingly difficult to answer. A critical stumbling block is a dearth of tools that accurately map routers traversed by Internet traffic to the countries in which they are located. This paper presents Passport: a new approach for efficient, accurate country-level router geolocation and a system that implements it. Passport provides location predictions with limited active measurements, using machine learning to combine information from IP geolocation databases, router hostnames, whois records, and ping measurements. We show that Passport substantially outperforms existing techniques, and identify cases where paths traverse countries with implications for security, privacy, and performance.First author draf

HLOC: Hints-Based Geolocation Leveraging Multiple Measurement Frameworks

Geographically locating an IP address is of interest for many purposes. There are two major ways to obtain the location of an IP address: querying commercial databases or conducting latency measurements. For structural Internet nodes, such as routers, commercial databases are limited by low accuracy, while current measurement-based approaches overwhelm users with setup overhead and scalability issues. In this work we present our system HLOC, aiming to combine the ease of database use with the accuracy of latency measurements. We evaluate HLOC on a comprehensive router data set of 1.4M IPv4 and 183k IPv6 routers. HLOC first extracts location hints from rDNS names, and then conducts multi-tier latency measurements. Configuration complexity is minimized by using publicly available large-scale measurement frameworks such as RIPE Atlas. Using this measurement, we can confirm or disprove the location hints found in domain names. We publicly release HLOC's ready-to-use source code, enabling researchers to easily increase geolocation accuracy with minimum overhead.Comment: As published in TMA'17 conference: http://tma.ifip.org/main-conference

Systems for characterizing Internet routing

2018 Spring.Includes bibliographical references.Today the Internet plays a critical role in our lives; we rely on it for communication, business, and more recently, smart home operations. Users expect high performance and availability of the Internet. To meet such high demands, all Internet components including routing must operate at peak efficiency. However, events that hamper the routing system over the Internet are very common, causing millions of dollars of financial loss, traffic exposed to attacks, or even loss of national connectivity. Moreover, there is sparse real-time detection and reporting of such events for the public. A key challenge in addressing such issues is lack of methodology to study, evaluate and characterize Internet connectivity. While many networks operating autonomously have made the Internet robust, the complexity in understanding how users interconnect, interact and retrieve content has also increased. Characterizing how data is routed, measuring dependency on external networks, and fast outage detection has become very necessary using public measurement infrastructures and data sources. From a regulatory standpoint, there is an immediate need for systems to detect and report routing events where a content provider's routing policies may run afoul of state policies. In this dissertation, we design, build and evaluate systems that leverage existing infrastructure and report routing events in near-real time. In particular, we focus on geographic routing anomalies i.e., detours, routing failure i.e., outages, and measuring structural changes in routing policies