Detecting and Characterizing Massively Shared IP Addresses

Abstract

IP addresses are commonly shared across devices and users for a variety of reasons, including NAT and proxies. These technologies operate at different scales, from residential NATs that share an IP address across devices in a home to large-scale Carrier Grade NATs that share hundreds or thousands of users on a single IP. Cases of large-scale IP sharing are distinct as they have significant implications for IP-based mechanisms such as attribution, blocklisting, and rate-limiting, where the consequences of mishandling affect a large quantity of end-users and organizations. In this work, we detect and characterize IP addresses shared at large scales, which we coin massively shared. Leveraging diurnal patterns in traffic shape, we use data from a large CDN to characterize these IPs globally. We broadly find that massive IP sharing is responsible for a large fraction of IPv4 traffic, concentrated in a small fraction of address space, with over 40% of total traffic coming from less than 2% of active IP addresses. We observe distinct patterns in deployment geographically, with particularly high rates of massively shared traffic from some smaller countries. Comparatively, in IPv6, we find far fewer massively shared addresses with some surprising exceptions among mobile providers. We additionally contextualize these addresses by other network characteristics, including identifying cellular connectivity and dual-stack capabilities, and identifying several instances of massively shared IPs in proxy services hosted on cloud networks. Finally, we find that rates of massively shared traffic are increasing over time, predicting future reliance on these technologies. Our work contextualizes the state of IP sharing, providing a uniquely broad perspective globally.