Title: Evaluating the State of Internet Deployments

Date: December 1st, 2025

Time: 2pm-4pm ET

Location: CODA C1015, https://gatech.zoom.us/j/97826640053?pwd=2BHHTwh1tkelw47Q2EHbnNkb0lxbck.1 

Amanda Hsu

Ph.D. CS Student

School of Cybersecurity and Privacy

College of Computing

Georgia Institute of Technology

Committee:

Dr. Frank Li (School of Cybersecurity and Privacy, Georgia Institute of Technology)

Dr. Paul Pearce (School of Cybersecurity and Privacy, Georgia Institute of Technology)

Dr. Cecilia Testart (School of Cybersecurity and Privacy, Georgia Institute of Technology)

Abstract:

Internet infrastructure has evolved significantly since its inception. However, monitoring and characterizing Internet infrastructure, such as performance and deployment of various technologies, presents open problems and gaps with significant implications. As IPv6 deployment increases, measurement techniques and analysis in IPv4 leave behind a large fraction of the Internet. Moreover, in IPv4 and IPv6 alike, large-scale deployment of Infrastructure that shares IPs (e.g., Carrier Grade NAT) complicates IP-based problems, such as blocklisting, yet measuring their existence remains a challenge for network providers and researchers alike. From these problem areas arise other questions, including questions of sampling bias in performance evaluation. This proposal discusses empirical methods to fill these gaps as well as future directions for my dissertation.

First, we discuss work that evaluated assumptions around IPv6 allocation properties, largely in the context of IPv6 active address generation. With such a vast address space, IPv6 deployment strategies vary significantly, and heuristics appropriate for IPv4 measurement are no longer effective. We fill this gap by characterizing IPv6 addressing from the ground up with data from the governing organizations that allocate Internet number resources, finding that such heuristics do not exist and deployment strategies vary significantly. We make recommendations for future work in IPv6 measurement that have since been used in work to identify and measure active IPv6 networks.

Next, we discuss the impact of IP protocol on measured Internet speed in access networks. Although speed tests have been used in a variety of prior work to understand access network throughput, few have considered the role of IP version in the test results. Using a residential measurement platform, we systematically execute and compare speed tests in multiple software in each IP version. In up to 18.3% of experiments, throughput differs significantly (>5%) between IP versions. We find that several measurement characteristics affect the output of such experiments, including the speed test server and software type. This work highlights an important, yet frequently forgotten, network characteristic and calls for future work to rethink analysis and measurement.

Then, we present a method to detect IP sharing technologies (such as Carrier-Grade NAT and proxies) from the perspective of a large Content Delivery Network (CDN). Existing IP sharing techniques rely on traffic volume, broad characterization of client diversity, or on-client measurements. In this work, we overcome these challenges and present a method that solely relies on high-level traffic patterns, leveraging Fourier analysis and curve-fitting evaluation. Our findings paint a stark picture of the Internet; over 40% of IPv4 traffic emerges from less than 2% of active addresses. Our work fills a critical gap in Internet infrastructure characterization, including comparing the state of IPv6 deployment in the context of IPv4 sharing.

Finally, we introduce ongoing work that addresses additional questions in performance measurement and technology deployment. This includes measuring and quantifying the bias that emerges from crowd-sourced (user-initiated) speed tests.