---

Historical Measurements

1. IPv6 Topology Discovery Techniques: Using Ark's topo-on-demand interface, researchers at the Naval Postgraduate School ran experiments to conduct IPv6 topology discovery. The vast size of the IPv6 address space (2¹²⁸ addresses) made random or sequential approaches impractical. These experiments targeted practical methods of dividing the address space to discover active subnets. A paper describing the results of these experiments was presented at the Passive and Active Network Measurement Workshop (IPv6 Alias Resolution via Induced Fragmentation, PAM 2013).

2. MERLIN: MEasure the Router Level of the INternet: In 2011, researchers at Université de Strasbourg, the Université catholique de Louvain, and Waikato University, ran alias resolution experiments with the probing tool, MERLIN. Run from an Ark monitor in San Diego as a vantage point, MERLIN took advantage of mrinfo, a multicast management tool that silently collected all IPv4 multicast enabled interfaces of a router and all its multicast links toward its neighbors. Further, the group made use of 1.2 million IP addresses sourced from CAIDA's traceroute measurements conducted on Ark as destination addresses in the measurements to discover MPLS and fingerprint networks on the Internet. A paper describing the results of the experiment was published in the proceedings of the Conference on Next Generation Internet (MERLIN: MEasure the Router Level of the INternet, NGI 2011).

3. RIPE-NCC World IPv6 Day Measurements: The RIPE NCC performed measurements related to World IPv6 Day, which took place on 8 June 2011. As a part of this effort, they monitored many of the participating websites from three sets of vantage points: the RIPE NCC Test Traffic Measurements platform; Ark nodes, contributed by CAIDA; and nodes contributed by partners and other infrastructures, such as RIPE Atlas. From these vantage points, monitoring effort periodically checked: DNS entries -- to check whether the World IPv6 Day participants had A/AAAA records; RTT distances using ping/ping6; forward path discovery using traceroute and traceroute6; and HTTP page fetches -- over IPv4 and IPv6 when available. We measured 60 participants from 53 vantage points, and executed 6,651,575 measurements between June 1-12, 2011.

4. Load balancer turnover and packet field sensitivity: Researchers with the WAND research group at the University of Waikato ran an experiment, conducted over approximately eight weeks, to carry out traceroutes using the Multipath Discovery Algorithm (MDA) in TCP source port, UDP source port and ICMP echo modes. The traces conducted several measurements per destination and investigated the possible existence of successor forwarding decision by fields outside the standard flow 5-tuple. The experiment also studied the efficiency of MDA analysis under different modes of flow ID selection. The target addresses were derived from prefixes provided by the Route Views Project. A selection of 400,000 pingable addresses were used to create smaller randomly selected address sets of 70,000 thought to be mid-path, router interfaces. These measurements ran during the summer in 2013. (Implementing Internet topology analysis with emphasis on load balancers and using large numbers of vantage points, 2016)

5. TCP Behavior Inference (TBIT): Assessing the deployment of TCP algorithms is integral to understanding the ability of TCP to perform. We used Ark infrastructure to infer the deployment of TCP algorithms and features in the modern Internet using an approach based on the TCP Behavior Inference Tool (TBIT), with a focus on the deployment of slow-start behaviors, as well as feasibility of blind in-window TCP attacks. (Resilience of Deployed TCP to Blind Attacks, 2017)

6. IPv4 and IPv6 stability: We worked with researchers at Simula Research Laboratory, we studied IPv4 and IPv6 stability and performance: From dual-stacked Ark monitors, we ran measurements (high-frequency pings and traceroutes over IPv4 and IPv6) towards dual-stacked servers from the Alexa list. The objective was to compare the reachability and performance (in terms of RTT) of dual-stacked targets over IPv4 and IPv6. (Leveraging the IPv4/IPv6 Identity Duality by using Multi-Path Transport, IEEE Global Internet Symposium 2015)

7. Domain Name System (DNS) Health: Working with researchers at Verisign Labs, we used Ark nodes to establish diagnostic monitoring of authoritative servers from diverse vantage points, to establish a baseline of response behavior and quantify connectivity issues as well as those that might emerge with a root key rollover. From each Ark node we issued periodic queries to each top-level domain (TLD) server. The queries included transport-layer tests to detect connectivity issues over both TCP and UDP, PMTU bounding tests to identify servers affected by a smaller PMTU than the payload they attempt to send, version consistency tests to detect stale zone data from servers that are out of sync, and DNSSEC correctness and consistency tests. Results were aggregated and stored for both point-in-time (simultaneous consistency) and temporal analysis (behavioral changes over time).

8. TCP-HICCUPS: HICCUPS (Handshake-based Integrity Check of Critical Underlying Protocol Semantics), from researchers at the Naval Postgraduate School, was a lightweight extension to TCP that helped end-hosts infer middlebox packet header modifications. By using HICCUPS, end-nodes could better cooperate with middleboxes and improve application performance. Measurement results from a SIGCOMM publication used HICCUPS on 58 Ark vantage points as part of an Internet-wide survey of Internet path behavior. (A middlebox-cooperative TCP for a non end-to-end internet, SIGCOMM 2014)

9. Middlebox Policy Taxonomy: Korian Edeline and Benoit Donnet at the Université de Liège, Belgium deployed tracebox on dual-stack Ark vantage points to compare middleboxes in IPv4 and IPv6 environments. From Ark vantage points, they probed all dual-stack servers from the top 1 Million Alexa web site. The dataset collected allowed the researchers to build a path impairment oriented middlebox taxonomy that aimed at categorizing the initial purpose of a middlebox policy as well as its potential unexpected complications. They found that the amount of paths crossing a middlebox with security-related policies is higher over IPv6 than IPv4. They found that routers had rewriting policies enabled in 8.5% of IPv4 paths and 12.3% of IPv6 paths, and also found a rather small amount of paths comprising middleboxes with dropping policies. Towards a Middlebox Policy Taxonomy: Path Impairments, NetSciCom 2015)

10. Localizing Middleboxes: The University of Waterloo utilized Ark infrastructure to accurately detect and localize middleboxes in the Internet for purposes of debugging the network and identifying misbehaving middleboxes. Other applications included detecting censorship and ICMP blackholes. The project also studied deployability of multipath TCP.

11. Transport Evolution: Researchers from Université de Liège, Belgium, ETH Zurich, Switzerland, and RIPE NCC, Amsterdam, Netherlands studied how the increasing use of middleboxes (e.g., NATs, firewalls) in the Internet has made it more difficult to deploy new transport or higher layer protocols. They used the Ark nodes to conduct measurements to examine the use of UDP for Internet transport evolution. (Using UDP for Internet Transport Evolution, ETH TIK Technical Report 2016)

12. Download speed tests encountering congestion

    Lightweight congestion measurements: As described in (NSF award CNS-1414177) Mapping Interconnection in the Internet: Colocation, Connectivity and Congestion, we ran measurements to detect congestion on interdomain links of the networks hosting the Ark monitors. We used Time-Sequence Latency Probing (TSLP), which involved sending a crafted sequence of pings along the path in question looking for a diurnal variation in delay potentially indicating congestion on a link. These measurements informed analysis of traffic congestion dynamics induced by evolving interconnection and traffic management practices of CDNs and ISPs.

13. Border mapping: CAIDA used Ark vantage points to research and develop measurement techniques to accurately infer the presence of interdomain links for the network hosting the Ark vantage point. With 19 vantage points (VPs) distributed across a large U.S. broadband provider, we used our method to reveal the tremendous density of router-level interconnection between some ASes. We applied our method to reveal the tremendous density and diversity of router-level interconnection between some pairs of ASes. We explored the parameter space of this method by computing the marginal gains of VP deployment inside one large access ISP, and the geographical diversity of VPs required to achieve a full view of this ISP's interconnectivity. We presented bdrmapIT, a traceroute analysis technique designed to infer the operating AS for routers and identify links between Internet networks. To evaluate bdrmapIT, we performed experiments from in-network and out-of-network VPs, validating the accuracy of our technique and demonstrating that bdrmapIT outperforms its predecessors. (bdrmap: Inference of Borders Between IP Networks, IMC 2016; Pushing the Boundaries with bdrmapIT: Mapping Router Ownership at Internet Scale, IMC 2018)

Publications

The CAIDA Resource Catalog lists papers that make use of Ark-related data sets.

Presentations

Feb 2016	Ark Topology Query System slideset
Mar 2015	Ark Update: Present and Future
Jun 2014	Dolphin: Bulk DNS Resolution Tool
Feb 2013	Ark Update: Vela and Raspberry Pi's
Feb 2012	Archipelago: On-Demand IPv4 and IPv6Topology Measurements
Feb 2011	Archipelago: Updates
Feb 2010	Archipelago: Updates and Case Study
Feb 2009	Archipelago: update and analyses
Aug 2008	Archipelago Measurement Infrastructure: Status and Experiences
Apr 2007	Archipelago: A Coordination-Oriented Measurement Infrastructure
Nov 2006	The Archipelago Measurement Infrastructure

Funding Support

Support for the Archipelago Measurement Infrastructure project is provided by the Defense Advanced Research Projects Agency (DARPA) cooperative agreement HR00112020014 Performance Evaluation Network Measurements and Analytics, the Department of Homeland Security (DHS) cooperative agreement FA8750-18-2-0049 Advancing Scientific Study of Internet Security Topological Stability, S&T contract HHSP 233201600012C Science of Internet Security: Technology Experimental Research, S&T contract NBCHC070133 Supporting Research Development of Security Technologies through Network Security Data Collection, and S&T cooperative agreement FA8750-12-2-0326 Supporting Research and Development of Security Technologies through Network and Security Data Collection, and the National Science Foundation (NSF) grants CNS-0958547 Internet Laboratory for Empirical Network Science, CNS-1513283 Internet Laboratory for Empirical Network Science: Next Phase, CNS-1901517 Strategies for Large-Scale IPv6 Active Mapping, CNS-1925729 Facilitating Advances in Network Topology Analysis, CNS-2120399 Integrated Library for Advancing Network Data Science, OAC-1724853 Integrated Platform for Applied Network Data Analysis, and OAC-2131987 Designing a Global Measurement Infrastructure to Improve Internet Security. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of DARPA, DHS, NSF, or the U.S. Government.