Connectivity Maps

This method of presenting data gathered by active network monitoring gives us an immediate overview of connectivity and its trends. Individual IP addresses on the network are spread over the vertical axis, while the horizontal represents time. For a class C network, the image will then always have a height of 255 pixels. Each discrete point on the map signifies whether the particular host was up at the given point in time.

Below we display the results from three scans of class C networks belonging to ISPs in three different cities. As each dataset covers several days, the patterns immediately reveal the daily cycle of usage:




We can immediately spot facts of interest, such as hosts which seem to be permanently connected (continuous red lines), addresses never taken up by hosts (or hosts which are always down), rhythms in connectivity corresponding to changing times of day, etc. In the first map, we can instantly spot an interesting phenomenon and get strong hints for its explanation. The blank area in the top-left corner seems to be a block of addresses which was removed from the DHCP address pool for the network. When the block is re-activated, we see the addresses assigned again, in sequence, shown by the slightly sloped line separating the dead zone from the active.

Since scanning a class C network gives us data (255 bits) best presented linearly, we get a 2-dimensional map once we add time. If we were scanning a class B network, we wouldn't need time to produce the second dimension: the two varying numbers in the IP address (A.B.*.*) provide data that can be presented as a 2-D map for every snapshot. Here is an example:


Note that if we added time to these class B maps, we could produce videos indicating changing connectivity in various areas of the address space. Another interesting video map would be one created by taking the time-address maps demonstrated by the first three images, and folding them at a regular interval corresponding to connectivity rhythms to produce videos reflecting changes in day-to-day dynamics.

Return to the main page.