Infer Leased IP Prefixes

This repo contains the analysis code for the IMC 2024 paper Sublet Your Subnet: Inferring IP Leasing in the Wild.

Reference Format

@inproceedings{10.1145/3646547.3689010,
  author = {Du, Ben and Fontugne, Romain and Testart, Cecilia and Snoeren, Alex C. and claffy, kc},
  title = {Sublet Your Subnet: Inferring IP Leasing in the Wild},
  year = {2024},
  publisher = {Association for Computing Machinery},
  address = {New York, NY, USA},
  url = {https://doi.org/10.1145/3646547.3689010},
  doi = {10.1145/3646547.3689010},
  booktitle = {Proceedings of the 2024 ACM Internet Measurement Conference},
  numpages = {9},
  location = {Madrid, Spain},
  series = {IMC '24}
}

Results from paper

The 5 files named leases_[RIR]_20240401.json.gz contain the 47,318 inferred leased prefixes described in the paper. The prefixes were also annotated with RIR metadata and necesarry information to infer their lease (e.g. BGP origins as depicted in Figure 2 in the paper).

Curated reference datasets

• The leased prefixes reference dataset (positive labels) needs to be generated by RIPE.ipynb and ARIN.ipynb with the most up-to-date datasets. The registered brokers are listed in recognized_brokers_[RIR].txt. Note: NOT ALL PREFIXES IN THE GENERATED LIST ARE LEASED. Some registered brokers also function as ISPs and directly use certain prefixes for their customers. You need to filter such prefixes manually, or utilize the existing code in the notebook to perform the filtering.
• The non-leased prefixes reference dataset is included in the files named non_lease_[ISP]_pfx.csv. They are relatively stable compared to leased prefixes.

Data Requirement

To run the code, you need to download the following CAIDA datasets:

• CAIDA AS Relationship dataset
• CAIDA AS Organizations dataset
• CAIDA Routeviews Prefix2AS dataset

and RIR WHOIS database:

• RIPE (public)

• AFRINIC (public)

• ARIN (need to sign AUP)

• APNIC (need to sign AUP)

• LACNIC (need to sign AUP)