Document Open Access Logo

There Is More to Internet Invariants Than Meets the Eye

Authors Chris Misa , Walter Willinger , Ramakrishnan Durairajan , Reza Rejaie

PDF

File

Thumbnail PDF
PDF
OASIcs.NINeS.2026.22.pdf
  • Filesize: 0.93 MB
  • 26 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Networks → Public Internet
  • Mathematics of computing → Probability and statistics
  • Networks → Network structure
Keywords
  • Internet traffic
  • self-similarity
  • multifractal scaling
  • reverse-engineering

Metrics

Abstract

A rich body of literature assembled over the last 30 years shows that traffic traversing wide-area Internet links is consistent with self-similar (temporal) scaling behavior and that sets of observed addresses have multifractal (spatial) scaling behavior. In view of this empirical evidence, these behaviors cannot be viewed as mere mathematical curiosities but should justifiably be called invariants of measured Internet traffic (Internet invariants, for short). At the same time, it is fair to say that the early architects of the Internet were largely unaware of these properties and certainly did not intend to design a network so that the traffic traversing its links would exhibit self-similar scaling in time or multifractal scaling in the IP address space.

In this paper, we resolve this apparent disconnect between architectural intentions and observed behaviors by applying a three-part framework that leverages, at its core, the perspective of Highly Optimized Tolerance (HOT). In particular, we take inspiration from studies on the origins of (temporal) self-similarity in measured Internet traffic but focus on a fundamentally new approach to understanding multifractal (spatial) scaling behavior. Specifically, we examine whether this invariant can be viewed as a visible hallmark of underlying but largely unknown robust design efforts, and explore a reverse-engineering approach to determine the concrete nature of the constrained optimization problems that these robust designs solve. Based on the insights gained from such reverse-engineering efforts, we speculate on the benefits of future efforts at forward-engineering - systematically leveraging the identified robust designs in order to provide scientifically sound intellectual foundations and practical principles for designing future networked systems.

Cite As Get BibTex

Chris Misa, Walter Willinger, Ramakrishnan Durairajan, and Reza Rejaie. There Is More to Internet Invariants Than Meets the Eye. In 1st New Ideas in Networked Systems (NINeS 2026). Open Access Series in Informatics (OASIcs), Volume 139, pp. 22:1-22:26, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/OASIcs.NINeS.2026.22

Author Details

Chris Misa
  • University of Oregon, Eugene, OR, USA
Walter Willinger
  • Northwestern University, Evanston, IL, USA
  • University of Oregon, Eugene, OR, USA
Ramakrishnan Durairajan
  • University of Oregon, Eugene, OR, USA
  • Link Oregon, Portland, OR, USA
Reza Rejaie
  • University of Oregon, Eugene, OR, USA

Funding

This work is supported by the National Science Foundation (OAC-2126281, SaTC-2132651, CICI-2319944, and CNS-2212590). The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of NSF.

Acknowledgements

We thank our shepherd (John Heidemann) and the anonymous reviewers for their constructive feedback. The work of the second author was done while at NIKSUN, Inc., Princeton, NJ.

References

  1. David L Alderson and John C Doyle. Contrasting views of complexity and their implications for network-centric infrastructures. IEEE Transactions on systems, man, and cybernetics-Part A: Systems and humans, 40(4):839-852, 2010. URL: https://doi.org/10.1109/TSMCA.2010.2048027.
  2. Martin F Arlitt and Carey L Williamson. Web server workload characterization: The search for invariants. ACM SIGMETRICS Performance Evaluation Review, 24(1):126-137, 1996. URL: https://doi.org/10.1145/233013.233034.
  3. Berk Atikoglu, Yuehai Xu, Eitan Frachtenberg, Song Jiang, and Mike Paleczny. Workload analysis of a large-scale key-value store. In Proceedings of the 12th ACM SIGMETRICS/PERFORMANCE joint international conference on Measurement and Modeling of Computer Systems, pages 53-64, 2012. URL: https://doi.org/10.1145/2254756.2254766.
  4. Per Bak. How nature works: the science of self-organized criticality. Springer Science & Business Media, 2013. Google Scholar
  5. Paul Barford, Rob Nowak, Rebecca Willett, and Vinod Yegneswaran. Toward a model for source addresses of Internet background radiation. In Proc. of the Passive and Active Measurement Conference. Citeseer, 2006. Google Scholar
  6. Theophilus Benson, Aditya Akella, and David A Maltz. Network traffic characteristics of data centers in the wild. In Proceedings of the 10th ACM SIGCOMM conference on Internet measurement, pages 267-280, 2010. URL: https://doi.org/10.1145/1879141.1879175.
  7. Xue Cai and John Heidemann. Understanding block-level address usage in the visible Internet. In Proceedings of the ACM SIGCOMM 2010 Conference, pages 99-110, 2010. URL: https://doi.org/10.1145/1851182.1851196.
  8. CAIDA. The CAIDA UCSD anonymized Internet traces dataset - 2019. https://www.caida.org/data/monitors/passive-equinix-nyc.xml. Accessed: 2024-02.
  9. CAIDA. IPv4 census map - CAIDA. https://www.caida.org/archive/id-consumption/census-map/. Accessed: 2025-05.
  10. Jean M Carlson and John Doyle. Highly optimized tolerance: A mechanism for power laws in designed systems. Physical review E, 60(2):1412, 1999. Google Scholar
  11. Jean M Carlson and John Doyle. Complexity and robustness. Proceedings of the national academy of sciences, 99(suppl_1):2538-2545, 2002. Google Scholar
  12. Robert Chang, Pradeep Dogga, Andy Fingerhut, Victor Rios, and George Varghese. Scaling IP lookup to large databases using the CRAM lens. In 22nd USENIX Symposium on Networked Systems Design and Implementation (NSDI 25), pages 127-146, 2025. URL: https://www.usenix.org/conference/nsdi25/presentation/chang.
  13. Mung Chiang, Steven H Low, A Robert Calderbank, and John C Doyle. Layering as optimization decomposition: A mathematical theory of network architectures. Proceedings of the IEEE, 95(1):255-312, 2007. URL: https://doi.org/10.1109/JPROC.2006.887322.
  14. Mark E Crovella and Azer Bestavros. Self-similarity in World Wide Web traffic: Evidence and possible causes. IEEE/ACM Transactions on networking, 5(6):835-846, 1997. URL: https://doi.org/10.1109/90.650143.
  15. John Doyle and Jean M Carlson. Power laws, highly optimized tolerance, and generalized source coding. Physical Review Letters, 84(24):5656, 2000. Google Scholar
  16. Jonathon Duerig, Robert Ricci, John Byers, and Jay Lepreau. Automatic IP address assignment on network topologies. Technical Note FTN200602, University of Utah Flux Group, 2006. Google Scholar
  17. Carl JG Evertsz and Benoit B Mandelbrot. Multifractal measures. Chaos and fractals, 1992:921-953, 1992. Google Scholar
  18. Jinliang Fan, Jun Xu, Mostafa H. Ammar, and Sue Moon. Cryptopan. https://web.archive.org/web/20190430122100/https://www.cc.gatech.edu/computing/Networking/projects/cryptopan/. Accessed: 2024-02.
  19. Sally Floyd and Vern Paxson. Difficulties in simulating the Internet. IEEE/ACM Transactions on networking, 9(4):392-403, 2001. URL: https://doi.org/10.1109/90.944338.
  20. V Fuller and T Li. RFC 4632: Classless inter-domain routing (CIDR): The Internet address assignment and aggregation plan, 2006. Google Scholar
  21. David Harte. Multifractals: theory and applications. Chapman and Hall/CRC, 2001. Google Scholar
  22. Amanda Hsu, Frank Li, and Paul Pearce. Fiat lux: Illuminating IPv6 apportionment with different datasets. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 7(1):1-24, 2023. URL: https://doi.org/10.1145/3579334.
  23. IANA. IPv6 global unicast address assignments. https://www.iana.org/assignments/ipv6-unicast-address-assignments/ipv6-unicast-address-assignments.xhtml. Accessed: 2024-01.
  24. IANA. IPv4 address space registry. https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml, 2023. Accessed: 2024-01.
  25. ISI. 62 days + almost 3 billion pings + new visualization scheme = the first Internet census since 1982. https://tinyurl.com/34t4dmn8. Accessed: 2025-05.
  26. Eddie Kohler, Jinyang Li, Vern Paxson, and Scott Shenker. Observed structure of addresses in IP traffic. In Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, pages 253-266, 2002. URL: https://doi.org/10.1145/637201.637242.
  27. Eddie Kohler, Jinyang Li, Vern Paxson, and Scott Shenker. Observed structure of addresses in IP traffic. IEEE/ACM Transactions on Networking, 14(6):1207-1218, 2006. URL: https://doi.org/10.1145/1217692.
  28. Maria Korolov. AI workloads set to transform enterprise networks. https://www.networkworld.com/article/3963141/ai-workloads-to-transform-enterprise-networks.html, 2025. Accessed: 2025-09.
  29. Will E Leland, Murad S Taqqu, Walter Willinger, and Daniel V Wilson. On the self-similar nature of Ethernet traffic (extended version). IEEE/ACM Transactions on networking, 2(1):1-15, 1994. URL: https://doi.org/10.1109/90.282603.
  30. B. B. Mandelbrot. Limit lognormal multifractal measures. Frontiers of Physics: Proceedings of the Landau Memorial Conference, pages 309-340, 1990. Google Scholar
  31. Benoit B Mandelbrot. Fractals and scaling in finance: Discontinuity, concentration, risk. Springer, 1997. Google Scholar
  32. Paul McNamara. MIT selling 8 million coveted IPv4 addresses; Amazon a buyer. https://www.networkworld.com/article/962726/mit-selling-8-million-coveted-ipv4-addresses-amazon-a-buyer.html. Accessed 2026-01.
  33. Jelena Mirkovic, Genevieve Bartlett, John Heidemann, Hao Shi, and Xiyue Deng. Do you see me now? sparsity in passive observations of address liveness. In 2017 Network Traffic Measurement and Analysis Conference (TMA), pages 1-9. IEEE, 2017. URL: https://doi.org/10.23919/TMA.2017.8002908.
  34. Chris Misa, Ram Durairajan, Arpit Gupta, Reza Rejaie, and Walter Willinger. The multifractal IP address structure: Physical explanation and implications. arXiv preprint arXiv:2504.01374, 2025. Google Scholar
  35. Chris Misa, Ramakrishnan Durairajan, Reza Rejaie, and Walter Willinger. Leveraging prefix structure to detect volumetric DDoS attack signatures with programmable switches. IEEE Symposium on Security and Privacy (S&P) (Oakland), 2024. Google Scholar
  36. Giovane CM Moura, Carlos Ganán, Qasim Lone, Payam Poursaied, Hadi Asghari, and Michel van Eeten. How dynamic is the ISPs address space? Towards Internet-wide DHCP churn estimation. In 2015 IFIP Networking Conference (IFIP Networking), pages 1-9. IEEE, 2015. Google Scholar
  37. Mina Ossiander and Edward C Waymire. Statistical estimation for multiplicative cascades. The Annals of Statistics, 28(6):1533-1560, 2000. Google Scholar
  38. Ramakrishna Padmanabhan, Amogh Dhamdhere, Emile Aben, KC Claffy, and Neil Spring. Reasons dynamic addresses change. In Proceedings of the 2016 internet measurement conference, pages 183-198, 2016. Google Scholar
  39. Ramakrishna Padmanabhan, John P Rula, Philipp Richter, Stephen D Strowes, and Alberto Dainotti. Dynamips: Analyzing address assignment practices in IPv4 and IPv6. In Proceedings of the 16th international conference on emerging networking experiments and technologies, pages 55-70, 2020. URL: https://doi.org/10.1145/3386367.3431314.
  40. Vern Paxson and Sally Floyd. Wide area traffic: the failure of Poisson modeling. IEEE/ACM Transactions on networking, 3(3):226-244, 1995. URL: https://doi.org/10.1109/90.392383.
  41. David Plonka and Arthur Berger. Temporal and spatial classification of active IPv6 addresses. In Proceedings of the 2015 Internet Measurement Conference, pages 509-522, 2015. URL: https://doi.org/10.1145/2815675.2815678.
  42. Sidney Resnick, Gennady Samorodnitsky, Anna Gilbert, and Walter Willinger. Wavelet analysis of conservative cascades. Bernoulli, 9(1):97-135, 2003. Google Scholar
  43. Philipp Richter, Georgios Smaragdakis, David Plonka, and Arthur Berger. Beyond counting: new perspectives on the active IPv4 address space. In Proceedings of the 2016 Internet Measurement Conference, pages 135-149, 2016. URL: http://dl.acm.org/citation.cfm?id=2987473.
  44. RIPE. IPv6 address allocation and assignment policy. https://www.ripe.net/publications/docs/ripe-552/, 2012. Accessed: 2024-10.
  45. Erik Rye, Robert Beverly, and Kimberly C Claffy. Follow the scent: Defeating IPv6 prefix rotation privacy. In Proceedings of the 21st ACM Internet Measurement Conference, pages 739-752, 2021. URL: https://doi.org/10.1145/3487552.3487829.
  46. Hadrien Salat, Roberto Murcio, and Elsa Arcaute. Multifractal methodology. Physica A: Statistical Mechanics and its Applications, 473:467-487, 2017. Google Scholar
  47. Patrick Sattler, Johannes Zirngibl, Mattijs Jonker, Oliver Gasser, Georg Carle, and Ralph Holz. Packed to the brim: Analyzing highly responsive prefixes on the Internet. https://hrp-stats.github.io/. Accessed: 2025-05.
  48. Joel Sommers and John Raffensperger. Efficient and realistic generation of IP addresses. In 4th International ICST Conference on Simulation Tools and Techniques, 2012. Google Scholar
  49. Gábor Soós, Dániel Ficzere, and Pál Varga. Investigating the network traffic of Industry 4.0 applications-methodology and initial results. In 2020 16th International Conference on Network and Service Management (CNSM), pages 1-6. IEEE, 2020. URL: https://doi.org/10.23919/CNSM50824.2020.9269093.
  50. Costa Tsaousis. FireHOL IP lists | IP blacklist | IP blocklists | IP reputation. http://iplists.firehol.org/. Accessed: 2025-01.
  51. Leo Vegoda. Assignments, allocations and temporary transfers. https://ipv4.global/events/assignments/. Accessed: 2024-10. Google Scholar
  52. Liang Wang, Hyojoon Kim, Prateek Mittal, and Jennifer Rexford. Raven: Stateless rapid IP address variation for enterprise networks. Proceedings on Privacy Enhancing Technologies, 2023. Google Scholar
  53. Herwig Wendt, Stéphane G Roux, Stéphane Jaffard, and Patrice Abry. Wavelet leaders and bootstrap for multifractal analysis of images. Signal Processing, 89(6):1100-1114, 2009. URL: https://doi.org/10.1016/J.SIGPRO.2008.12.015.
  54. Walter Willinger, Ramesh Govindan, Sugih Jamin, Vern Paxson, and Scott Shenker. Scaling phenomena in the Internet: Critically examining criticality. Proceedings of the National Academy of Sciences, 99(suppl_1):2573-2580, 2002. Google Scholar
  55. Walter Willinger, Murad S Taqqu, Robert Sherman, and Daniel V Wilson. Self-similarity through high-variability: statistical analysis of Ethernet LAN traffic at the source level. IEEE/ACM Transactions on networking, 5(1):71-86, 1997. URL: https://doi.org/10.1109/90.554723.
  56. Jackson Woodruff, Andrew W Moore, and Noa Zilberman. Measuring burstiness in data center applications. In Proceedings of the 2019 Workshop on Buffer Sizing, pages 1-6, 2019. URL: https://doi.org/10.1145/3375235.3375240.
  57. www.blocklist.de. Fail2Ban reporting service. https://www.blocklist.de/en/index.html. Accessed: 2025-01.
  58. Yinglian Xie, Fang Yu, Kannan Achan, Eliot Gillum, Moises Goldszmidt, and Ted Wobber. How dynamic are IP addresses? In Proceedings of the 2007 conference on Applications, technologies, architectures, and protocols for computer communications, pages 301-312, 2007. URL: https://doi.org/10.1145/1282380.1282415.
  59. Zihan Yan, Dan Li, Li Chen, Dian Xiong, Kaihui Gao, Yiwei Zhang, Rui Yan, Menglei Zhang, Bochun Zhang, Zhuo Jiang, et al. From ATOP to ZCube: Automated topology optimization pipeline and a highly cost-effective network topology for large model training. In Proceedings of the ACM SIGCOMM 2025 Conference, pages 861-881, 2025. Google Scholar
  60. Jieyu Zheng and Markus Meister. The unbearable slowness of being: Why do we live at 10 bits/s? Neuron, 113(2):192-204, 2025. Google Scholar
  61. Xiaoyun Zhu, Jie Yu, and John Doyle. Heavy tails, generalized coding, and optimal web layout. In Proceedings IEEE INFOCOM 2001. Conference on Computer Communications. Twentieth Annual Joint Conference of the IEEE Computer and Communications Society (Cat. No. 01CH37213), volume 3, pages 1617-1626. IEEE, 2001. URL: https://doi.org/10.1109/INFCOM.2001.916658.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2025 Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact