Detecting and Characterizing Massively Shared IP Addresses

2026-08-06

AI Summary

This study addresses the significant disruption caused by large-scale IP address sharing—such as carrier-grade NATs and proxies—to IP-based attribution, blocking, and rate-limiting mechanisms. For the first time, it systematically identifies and characterizes such shared IPs at a global scale by leveraging diurnal traffic patterns from CDNs, behavioral clustering of IP addresses, and network-level features including cellular connectivity and dual-stack capability. The findings reveal that over 40% of IPv4 traffic originates from fewer than 2% of active IPs, with sharing particularly pronounced and growing in smaller countries. While IPv6 exhibits substantially less sharing overall, mobile networks present a notable exception. This work provides critical insights into the global distribution, origins, and evolutionary trends of IP sharing, offering foundational implications for network measurement and security policy design.

Abstract

IP addresses are commonly shared across devices and users for a variety of reasons, including NAT and proxies. These technologies operate at different scales, from residential NATs that share an IP address across devices in a home to large-scale Carrier Grade NATs that share hundreds or thousands of users on a single IP. Cases of large-scale IP sharing are distinct as they have significant implications for IP-based mechanisms such as attribution, blocklisting, and rate-limiting, where the consequences of mishandling affect a large quantity of end-users and organizations. In this work, we detect and characterize IP addresses shared at large scales, which we coin massively shared. Leveraging diurnal patterns in traffic shape, we use data from a large CDN to characterize these IPs globally. We broadly find that massive IP sharing is responsible for a large fraction of IPv4 traffic, concentrated in a small fraction of address space, with over 40% of total traffic coming from less than 2% of active IP addresses. We observe distinct patterns in deployment geographically, with particularly high rates of massively shared traffic from some smaller countries. Comparatively, in IPv6, we find far fewer massively shared addresses with some surprising exceptions among mobile providers. We additionally contextualize these addresses by other network characteristics, including identifying cellular connectivity and dual-stack capabilities, and identifying several instances of massively shared IPs in proxy services hosted on cloud networks. Finally, we find that rates of massively shared traffic are increasing over time, predicting future reliance on these technologies. Our work contextualizes the state of IP sharing, providing a uniquely broad perspective globally.

Problem

• massively shared IP
• IP address sharing
• Carrier Grade NAT
• IPv4 traffic
• attribution

Innovation

• massively shared IP
• diurnal traffic patterns
• Carrier Grade NAT
• IP address sharing
• CDN telemetry