This method of presenting data gathered by active network monitoring gives
us an immediate overview of connectivity and its trends. Individual IP
addresses on the network are spread over the vertical axis, while the
horizontal represents time. For a class C network, the image will then
always have a height of 255 pixels. Each discrete point on the map signifies whether
the particular host was up at the given point in time.
Below we display the results from three scans of class C networks belonging to ISPs in three different cities. As each dataset covers several days, the patterns immediately reveal the daily cycle of usage:
We can immediately spot facts of interest, such as hosts which
seem to be permanently connected (continuous red lines), addresses never taken
up by hosts (or hosts which are always down), rhythms in connectivity
corresponding to changing times of day, etc. In the first map, we can instantly
spot an interesting phenomenon and get strong hints for its explanation. The
blank area in the top-left corner seems to be a block of addresses which was
removed from the DHCP address pool for the network. When the block is re-activated, we see the addresses assigned again, in sequence, shown by the slightly sloped line separating the dead zone from the active.
Since scanning a class C network gives us data (255 bits) best presented linearly, we get a
2-dimensional map once we add time. If we were scanning a class B network, we wouldn't need time to produce the second dimension: the two varying numbers in the IP address (A.B.*.*) provide data that can be presented as a 2-D map for every snapshot. Here is an example:
Note that if we added time to these class B maps, we could produce videos indicating changing
connectivity in various areas of the address space. Another interesting video map would be one created by taking the time-address maps demonstrated by the first three images, and folding them at a regular interval corresponding to connectivity rhythms to produce videos reflecting changes in day-to-day dynamics.
to the main page.