Telescope Traces and Heatmaps

To visualize the use of IPv4 Internet address space, we create heatmaps that use intensity of color (heat) to show the use of addresses belonging to the same network. These heatmaps also make use of a fractal mapping technique that describes a space-fitting curve. This technique, most recently popularized by Randall Munroe's xkcd #195, John Heidemann's ping-based Censuses of IPv4 Space and Duane Wessels' maps of Routeviews BGP, open DNS resolvers, and RIR IPv4 whois data, keeps adjacent IP addresses close to one another in the map.

IPv4 Address Space Maps

The following figure shows the mapping of the sources IP addresses of packets extracted from the telescope traces in November and December 2009; the labeled blocks are based on IANA's list of IPv4 allocations.

The IP addresses belong mostly to the address space allocated through the Regional Internet Registries: RIPE, APNIC, ARIN, LACNIC, and AfriNIC. The figure also shows some addresses in the areas labeled "Various Registries" indicating allocations from the former "class B" and "class C" before the mid-1990s.

Addresses in the areas labeled as "Unallocated", "Multicast", "Future use" and in the "class A" address blocks appearing in the upper left of the map are rare.

Figure 1. IPv4 address space map of the sources IP addresses of packets extracted from the telescope traces in November and December 2009.

Filtering only the packets sent to tcp port 445, representing on average the 70-80% of the telescope traffic we obtained the map in Figure 2.

Figure 3 evaluates the source address space of the remaining 20-30%. In the second case the figure shows a high similarity level with the figure representing the map of all the packets. The sources that send packets to the port 445 come from less widespread points of the address space map.

Figure 2 and 3. IPv4 address space map of the sources IP addresses of packets sent to port 445 (left) and sent to a port different from 445 (right).

The figures are obtained using the IPv4 Heatmap Software by The Measurement Factory.