A technique for counting natted hosts Export

@inproceedings{citeulike:4123715, abstract = {There have been many attempts to measure how many hosts are on the Internet. Many of those end-points, however, are NAT boxes (Network Address Translators), and actually represent several different computers. We describe a technique for detecting NATs and counting the number of active hosts behind them. The technique is based on the observation that on many operating systems, the IP header's ID field is a simple counter. By suitable processing of trace data, packets emanating from individual machines can be isolated, and the number of machines determined. Our implementation, tested on aggregated local trace data, demonstrates the feasibility (and limitations) of the scheme.}, address = {New York, NY, USA}, author = {Bellovin, Steven M.}, booktitle = {IMW '02: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment}, citeulike-article-id = {4123715}, citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=637201.637243}, citeulike-linkout-1 = {http://dx.doi.org/10.1145/637201.637243}, citeulike-linkout-2 = {http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.16.9287}, doi = {10.1145/637201.637243}, isbn = {1-58113-603-X}, keywords = {nat}, location = {Marseille, France}, pages = {267--272}, posted-at = {2009-09-16 01:06:53}, priority = {0}, publisher = {ACM}, title = {A technique for counting natted hosts}, url = {http://dx.doi.org/10.1145/637201.637243}, year = {2002} }

TY - CONF ID - citeulike:4123715 L3 - citeulike-article-id:4123715 N2 - There have been many attempts to measure how many hosts are on the Internet. Many of those end-points, however, are NAT boxes (Network Address Translators), and actually represent several different computers. We describe a technique for detecting NATs and counting the number of active hosts behind them. The technique is based on the observation that on many operating systems, the IP header's ID field is a simple counter. By suitable processing of trace data, packets emanating from individual machines can be isolated, and the number of machines determined. Our implementation, tested on aggregated local trace data, demonstrates the feasibility (and limitations) of the scheme. CY - Marseille, France SN - 1-58113-603-X AD - New York, NY, USA EP - 272 TI - A technique for counting natted hosts PB - ACM T2 - IMW '02: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment SP - 267 KW - nat AU - Bellovin, Steven PY - 2002/// UR - http://dx.doi.org/10.1145/637201.637243 ER -