Pith. sign in

REVIEW 4 major objections 6 minor 41 references

Durbin: Internet Outage Detection with Adaptive Passive Analysis

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Durbin detects Internet outages from passive traffic with 5-minute and /24 precision by adapting detection timing per block.

desk verdict Durbin's per-block adaptive passive detection is a genuine advance, but the short-outage and IPv6 claims rest on a validation that needs reworking before the paper is ready. read the letter →

arxiv 2411.17958 v1 pith:S2FFJ4FT submitted 2024-11-27 cs.NI

Asma Enayet , John Heidemann This is my paper · ORCID
classification cs.NI
keywords internetoutagedetectionpassivemeasurementper-blockadaptivitytemporalprecisionIPv6outagesBayesianinferencenetworkreliabilityDNSroottraffic
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Durbin claims that passive observation of ordinary network traffic is enough to detect Internet outages with the fine spatial precision of active systems—/24 blocks in IPv4 and /48 blocks in IPv6—while adding temporal precision active systems cannot safely reach. The method learns, for each address block, how often traffic is expected to arrive, then chooses a short detection timebin (5 minutes) for frequently used blocks and a longer one (25 minutes) for sparse blocks, so accuracy does not collapse when data is thin. Against Trinocular's active measurements, Durbin reports near-perfect positive predictive value (0.9999) and good true negative rate (0.84), and against Disco it detects outages as short as five minutes with PPV 0.977. It also produces the first IPv6 outage measurements, covering about 15k /48 blocks. If these claims hold, outage monitoring no longer has to choose between seeing behind firewalls and seeing small, short failures.

What carries the argument

The load-bearing mechanism is per-block parameter adaptation: for every address, Durbin estimates the probability $\pi(a)$ that traffic appears in a timebin, chooses a short or long timebin $T(a)$ according to whether traffic is frequent or sparse, and feeds each timebin's positive-or-negative observation through a Bayesian belief update (Equations 1–2), clamping belief to $[0.1, 0.95]$. Address beliefs are combined into a block belief by taking the maximum, with block timebin set by the most sensitive address. This adaptivity is what lets one algorithm hold spatial precision constant at /24 (IPv4) and /48 (IPv6) while varying temporal precision from 5 to 25 minutes, and it is the reason coverage stays at about 85% of B-root blocks with TNR 0.811 instead of 0.647 for a fixed 25-minute timebin.

What would settle it

Compare every Durbin 5-minute outage event in a sample of blocks against independent router-level ground truth, such as BGP update logs, router syslogs, or an ISP's own alarm data; if most events have no corresponding connectivity change, the short-outage claim is wrong. A cheaper check is to run the Durbin-versus-Disco comparison on all blocks where both systems have coverage instead of the 10.5k in the paper and see whether PPV and TNR survive.

Watch

Extended reading notes

Core claim

The paper's central claim is that outage detection can be made adaptive per network block, and that this single change lets passive monitoring match active systems' spatial precision, beat their temporal precision, and extend to IPv6. Durbin models each address by its historical probability $\pi(a)$ of producing traffic in a timebin of duration $T(a)$, and updates a Bayesian belief $B(a)$ after every timebin that does or does not contain traffic; block-level belief is the maximum over member addresses. Blocks with frequent traffic are assigned a 5-minute timebin, sparse blocks 25 minutes, and the block is declared down when belief falls below threshold $\theta_b=0.6$. In validation against Trinocular over 880k shared /24 blocks, Durbin achieves PPV 0.9999 and TNR 0.8417 with a precision-aware comparison; against Disco on 10.5k blocks it detects 5-minute outages with PPV 0.9769, recall 0.9453, and TNR 0.7341. The paper reports that 5% of blocks have at least one 5-minute outage, that omitting 5–10 minute outages underestimates total outage duration by about 15–20%, and that IPv6 /48 blocks show outage fractions roughly ten times IPv4, with 12–13% of measurable blocks experiencing at least one outage per day.

Load-bearing premise

The load-bearing premise is that the extra short outages Durbin reports beyond Trinocular are real network failures and not artifacts of its detection sensitivity; this was checked against Disco on only about 10.5 thousand /24 blocks, while the global short-outage and IPv6 claims rest on that check.

Editorial extensions

If this is right

  • Outage reports can now include networks behind firewalls, since passive traffic already crosses those firewalls; active systems cannot probe them.
  • Short outages of 5–10 minutes become visible, and including them raises estimated total outage duration by 15–20%, so prior active-only measurements systematically understate outage burden.
  • IPv6 outage measurement becomes practical for about 15k /48 blocks from DNS-root traffic alone, with coverage potentially expanding to hundreds of thousands of blocks if run on CDN or Wikipedia data.
  • Per-block timebin selection improves true negative rate by roughly 20 percentage points over a fixed coarse timebin while retaining broad coverage, so a single global sensitivity setting is not the right operating point.
  • With B-root, Durbin covers about 1M /24 IPv4 blocks, roughly one-fifth of Trinocular's coverage, and with a major website's data it could match or exceed active methods.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to make the timebin continuous rather than choosing between 5 and 25 minutes, which could rescue some of the 15% of blocks that are currently unmeasurable; the paper flags this direction as future work.
  • The reported IPv6 outage fraction, about ten times IPv4, may be inflated by the smaller and noisier IPv6 passive sample; comparing Durbin's IPv6 detections against active IPv6 probes once a good hitlist exists would settle whether the gap is real.
  • The same per-block Bayesian machinery could be applied to active probing to cut probe traffic while catching short outages, since the belief model does not depend on whether the observations are passive or active.
  • If short outages are as common as reported, user-visible reliability is worse than active-only measurements suggest; providers and regulators should treat passive monitoring as a complementary source rather than a substitute.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. Durbin is a passive outage-detection system that models expected traffic per /24 (IPv4) or /48 (IPv6) block and applies Bayesian belief updates to flag gaps in passive observations. The paper evaluates Durbin on B-root DNS and Merit darknet data, compares it with Trinocular and Disco, reports high availability-side positive predictive value, and claims detection of short (5-minute) outages in about 5% of blocks, a 15-20% increase in measured outage duration when short outages are included, and the first IPv6 outage measurements. The central design idea is per-block adaptation of temporal precision (5 or 25 minutes for B-root, 20 minutes for darknet) to trade coverage against accuracy.

Significance. The core idea of adapting timebin duration and measurability thresholds per block for passive outage detection is a reasonable and potentially useful contribution, and the evaluation scale is substantial: roughly 880k /24 blocks for the Trinocular comparison, 60k for the darknet comparison, and 10.5k blocks for the Disco comparison. The Bayesian formulation is simple, and the paper is honest about several limitations, including lack of IPv6 ground truth and the need for future work. However, the evidence for the two headline claims (short-outage detection and IPv6 outages) is currently indirect and, in the case of the Disco comparison, the reported metrics are availability-centric rather than outage-centric. If the short-outage and IPv6 claims could be validated with outage-class metrics and an artifact analysis, the contribution would be significant for network measurement.

major comments (4)
  1. [§5.1.3, Table 2b] The near-perfect recall of 0.9985 is obtained after discarding disagreements shorter than the block's timebin, which removes the very short false outages that dominate the raw comparison. The raw recall in Table 2a is 0.6282, with 31,087,360,212 s of false outage, while the filtered Table 2b reduces false outage to 78,163,261 s. Since the paper's main contribution is the ability to detect 5-minute outages, this filter suppresses precisely the events the paper claims to measure, so the precision-aware recall cannot be used as evidence for short-outage accuracy. The statement that the false-outage duration 'drops to one-quarter of before' is also arithmetically inconsistent with the two table values (the reduction is by a factor of roughly 398).
  2. [§5.6, Table 5] The Disco comparison is the only external check of the short-outage signal, but its advertised PPV (0.9769) and recall (0.9453) define availability as the positive class. Re-reading the same table with outage as the event of interest gives 2,030 true outages, 1,799 false outages (FN), and 735 missed outages (FP), so Durbin's outage precision is about 53% and its outage recall about 73%. These numbers do not support the abstract and §1 claims that about 5% of blocks have short outages and that omitting them undercounts outage duration by 15-20%, especially because the comparison covers only 10.5k /24 blocks over seven days. Please report outage-class precision and recall and provide a representativeness argument or sensitivity analysis for the global extrapolation.
  3. [§5.5 and §3.5] The claimed 20% true-negative-rate improvement from the hybrid 5/25-minute configuration is computed on the same B-root dataset used to select θsparse and the timebins, so the improvement may reflect tuning to this dataset. In addition, §3.3 uses P(no|down) in the belief equations but never gives its value, and the reported 25-minute TNR is 0.647 in §5.5 but 0.674 in §5.4.1 and Figure 5a. Please provide exact parameter values, a held-out or cross-validated evaluation, and a sensitivity analysis to show that the per-block adaptation, rather than the chosen operating point, is responsible for the reported gain.
  4. [§6.1, Figure 6] The IPv6 outage claim (first IPv6 measurements, roughly 10× the IPv4 outage fraction) has no ground truth, and §5.1.5 explicitly acknowledges this. The transfer argument from IPv4 rests only on similar marginal traffic-rate distributions in Figure 1; address churn or temporary IPv6 addresses would produce the same traffic gaps without an actual outage. The text value 'from 0.6 to 1.5' is also inconsistent with Figure 6, whose y-axis is 0.0-0.2, and with the stated 9% outage fraction. Please present IPv6 results as unvalidated measurements and test for address-churn and sparsity artifacts before drawing reliability conclusions.
minor comments (6)
  1. [Abstract] The abstract contains a typo ('Durbin can report this results'); please proofread the manuscript.
  2. [§5.6] The sentence about outages 'as little as 5 minutes or less than 5 minutes' is too strong for a 5-minute timebin; sub-5-minute detection is not demonstrated by the current evaluation.
  3. [§6.1.1] The phrase 'from 0.6 to 1.5' appears to be a decimal error; the figure and the 9% statement suggest values around 0.06 to 0.15. Please verify the numbers against the figure.
  4. [Figure 5a] The rightmost bar mixes 5-minute dense blocks and 25-minute sparse blocks; please clarify how TNR is aggregated across blocks with different timebins so the comparison is interpretable.
  5. [§5.1.3] The phrase 'drops to one-quarter of before' should be corrected to reflect the approximately 398× reduction shown in Table 2b.
  6. [References] Reference [41] lists a dataset URL with 'ant.edu'; please confirm that this is the correct institution and that the data are publicly accessible.

Circularity Check

2 steps flagged · score 6.0 of 10

Short-outage prevalence is produced by a detector tuned on the same data, and the precision-aware validation filters out the very short events it claims to prove; long-outage and darknet results remain external.

  1. fitted input called prediction [§3.5, §5.3, §5.4, §5.6]
    "We chose 𝜃𝑏 = 0.6 to maximize sensitivity to short-duration outages. … Durbin identifies one empty timebin without traffic as an outage when the timebin duration is short, even if there is no actual outage shown in §4. … Our measurements show that on that week, around 5% of total blocks that have 5 minute outages that were not seen in prior work."

    The claimed prevalence of 'short outages' is a count produced by Durbin itself after the belief threshold was explicitly chosen to maximize short-outage sensitivity and after selecting a 5-minute timebin on the same B-root data. The paper's own text concedes that a short timebin flags empty bins as outages even when no outage exists. The 5% and 20% conclusions are therefore a projection of the chosen sensitivity, not an independently established property. The only external check, Table 5 vs. Disco, covers 10.5k blocks and, taking outage as the positive class, yields 2030/(2030+1799) ≈ 53% precision, while the reported PPV of 0.9769 is computed with availability as the positive class.

  2. self definitional [§5.1.3]
    "We define precision-aware comparison as ignore differences that are shorter than the measurement timebin for a given block. Ignoring these short differences is justified timebin phase is arbitrary, and it reflects more on quantization of outage detection into timebins than on the actual correctness of the underlying method. … The number and duration of false outage events drops to one-quarter of before, from 31.09 Gs to 78.16 Ms. We believe these improved results better reflect the true ability of passive observation to detect events."

    This evaluation removes the very disagreements shorter than the block's timebin, which includes the 5-minute outages that are the paper's headline contribution, then reports recall rising to 0.9985 and claims the results 'better reflect the true ability' of passive detection. The high agreement is thus obtained by definitionally excluding the target short-outage signal. The remaining 78.16 Ms of false outage still exceeds the 13.15 Ms of agreed outage, so the filtered metric does not establish the short-outage claim it is used to support.

full rationale

Durbin's core algorithm has substantial independent content: it uses Bayesian belief over passively observed traffic, and its long-outage accuracy is evaluated against Trinocular as external ground truth, with additional validation on the Merit darknet. These comparisons are self-contained and do not reduce to the paper's own parameters. However, the paper's headline short-outage contribution is partially circular. The belief threshold and 5-minute timebin are explicitly chosen to maximize sensitivity to short outages on the same B-root dataset, and the paper then reports that about 5% of blocks have 5-minute outages and that omitting them undercounts duration by 15–20%; these numbers are Durbin's own detections under the tuned parameters. The paper even acknowledges that short timebins produce false outages. The independent Disco check is limited to 10.5k blocks and, when the confusion matrix in Table 5 is read with outage as the positive class, Durbin's outage precision is only about 53%; the reported PPV and recall are for availability, not for outage detection. The precision-aware comparison in §5.1.3 further filters out sub-timebin disagreements before reporting near-perfect recall, which by construction removes much of the short-outage evidence. The IPv6 results are extrapolated from IPv4 by traffic-rate similarity rather than independently validated, which is not circular but adds uncertainty. Overall, the central short-outage and adaptive-precision claims reduce in part to the tuning choices and filtering definitions, while the long-outage IPv4 validation remains external, giving partial circularity.

Assumptions & free parameters 9 free parameters · 6 assumptions · 0 invented entities

The central claims depend on several hand-set thresholds and on ground-truth systems whose own accuracy is not quantified. The parameter values are fitted on the same datasets used for evaluation, so reported metrics are not held-out. P(no|down) is an unstated free parameter.

free parameters (9)
  • theta_measurable = 0.6
    Minimum pi(a) for an address to be considered measurable; set by inspection of the B-root traffic distribution (Section 3.2, Figure 1).
  • theta_sparse = 0.6
    Threshold dividing sparse from frequent addresses; chosen based on B-root coverage analysis (Section 3.5, Figure 1).
  • theta_a and theta_b = 0.6
    Belief threshold for declaring an address or block down; selected in the Section 5.3 sensitivity analysis on the same B-root data used for evaluation.
  • T_short (B-root) = 5 minutes
    Timebin for frequent-traffic blocks; chosen in Sections 5.4 and 5.5 to maximize the TNR/coverage tradeoff on B-root data.
  • T_long (B-root) = 25 minutes
    Timebin for sparse-traffic blocks; chosen in the same tradeoff analysis on B-root data.
  • T_darknet = 20 minutes
    Timebin for the Merit darknet source; chosen in Section 5.4 on darknet data.
  • B_min and B_max = 0.1 and 0.95
    Clipping bounds for belief to prevent the update from getting stuck at 0 or 1 (Section 3.3).
  • training window d = 2 days
    History length used to estimate pi(a) (Section 3.2).
  • P(no|down) = unstated
    Conditional probability of no traffic given the address is down; required in Eq. 2 and Table 1 but never assigned a value in the paper.
assumptions (6)
  • domain assumption Source IP addresses in B-root DNS queries indicate active, valid resolvers.
    Section 3.1 assumes B-root queries are legitimate and the source address implies a live network, with spoofed traffic only during attacks.
  • domain assumption Darknet source addresses, after CAIDA filtering, indicate live networks.
    Section 3.1 assumes the filtered darknet traffic originates from active hosts and is not spoofed.
  • domain assumption Absence of traffic in a timebin is evidence of a down state.
    The Bayesian update in Eqs. 1 and 2 treats a quiet timebin as evidence for unreachability; this assumes stationarity and that gaps are caused by outages rather than user behavior changes.
  • domain assumption IPv4 and IPv6 traffic rate distributions are similar enough that IPv4 accuracy transfers to IPv6.
    Section 4.1.1 and Section 5.1.5 argue that correctness depends on traffic rate and regularity, and that these are similar in IPv4 and IPv6, so IPv4 validation applies to IPv6.
  • domain assumption Trinocular's active probing is a valid ground truth for long-duration outages.
    Section 5.1 uses Trinocular as the reference for IPv4 outages, assuming its active measurements correctly identify reachability.
  • domain assumption Disco and RIPE Atlas disconnections are a valid ground truth for short-duration outages.
    Section 5.6 compares Durbin's short outages against Disco's inferences from RIPE Atlas long-running TCP connections, treating those as ground truth.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Durbin: Internet Outage Detection with Adaptive Passive Analysis." pith.science (2026). https://pith.science/paper/S2FFJ4FT

@misc{pith2026241117958,
  author       = {Pith},
  title        = {Pith review of: Durbin: Internet Outage Detection with Adaptive Passive Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/S2FFJ4FT}},
  note         = {Machine review of arXiv:2411.17958}
}
read the original abstract

Measuring Internet outages is important to allow ISPs to improve their services, users to choose providers by reliability, and governments to understand the reliability of their infrastructure. Today's active outage detection provides good accuracy with tight temporal and spatial precision (around 10 minutes and IPv4 /24 blocks), but cannot see behind firewalls or into IPv6. Systems using passive methods can see behind firewalls, but usually, relax spatial or temporal precision, reporting on whole countries or ASes at 5 minute precision, or /24 IPv4 blocks with 25 minute precision. We propose Durbin, a new approach to passive outage detection that adapts spatial and temporal precision to each network they study, thus providing good accuracy and wide coverage with the best possible spatial and temporal precision. Durbin observes data from Internet services or network telescopes. Durbin studies /24 blocks to provide fine spatial precision, and we show it provides good accuracy even for short outages (5 minutes) in 600k blocks with frequent data sources. To retain accuracy for the 400k blocks with less activity, Durbin uses a coarser temporal precision of 25 minutes. Including short outages is important: omitting short outages underestimates overall outage duration by 15%, because 5% of all blocks have at least one short outage. Finally, passive data allows Durbin to report this results for outage detection in IPv6 for 15k /48 blocks. Durbin's use of per-block adaptivity is the key to providing good accuracy and broad coverage across a diverse Internet.

Figures

Figures reproduced from arXiv: 2411.17958 by the authors.

Figure 1
Figure 1. Traffic per address for B-root on 2019-01-10 𝜃sparse as sparse and those with 𝑝𝑖(𝑎) > 𝜃sparse as frequent. With B-root as our data source we set 𝜃sparse as 0.6, and use 5 and 25 minutes as short and long timebins. With the Merit darknet as the source we set 𝜃measurable and 𝜃sparse as 0.6 and 𝑇 (𝑏) is 20 minutes. We use the same Durbin algorithm for each source, but choose parameters (𝜃sparse and 𝑇 (·)) based on anal… view at source ↗
Figure 2
Figure 2. Belief change in Durbin-with-B-root, varying traffic frequency and timebin duration. Data: 2019-01-10. 4.3 Belief for Addresses with Sparse Traffic For addresses with sparse traffic (when 𝜋 (𝑎) < 𝜃sparse), Durbin must be more cautious in determining when an out￾age occurs. Here we pick one example with 𝜋 (𝑎) = 0.6. Again we see similar results in the hundreds of other, sparse addresses where 𝜃measurable < 𝜋 (𝑎) < 𝜃s… view at source ↗
Figure 4
Figure 4. True outage detection rate for Durbin-with-B-root and Durbin￾with-the Merit darknet. Time bin duration (𝑇 (𝑏)) 15 minute 10 minute 5 minute TA 56,492,461,162 52,525,765,695 47,456,373,912 TO 11,234,345 13,147,965 14,092,345 FA 3,043,362 2,471,178 2,001,769 FO 72,036,450 78,163,261 128,124,934 PPV 0.9999 0.9999 0.9999 Recall 0.9999 0.9985 0.9973 TNR 0.7821 0.8417 0.8756 (a) Durbin-with-B-root Time bin duration (𝑇 (𝑏)… view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: Sensitivity of the timebin for Durbin-with- [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: IPv4 and IPv6: outage fraction 2019-01-09 2019-01-10 2019-01-11 2019-01-12 2019-01-13 2019-01-14 2019-01-15 Days 0.0 0.1 0.2 0.3 0.4 No. of blocks having atleast one outage Durbin (IPv4 DNS) Trinocular (IPv4) Durbin (IPv6 DNS) [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 8
Figure 8. Figure 8: Current (dark shades) and potential (light) [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: PPV, recall and TNR for seven days for Durbin [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 41 canonical work pages

  1. [1]

    In https://www.businesswire.com/news/home/20110510006495/en/At- a-Cost-of-More-Than-5000-Per-Minute-Data-Center-Outages-Can-Be- Painful-Emerson-Study-Shows

    Data-centers lose on about $5,000 per minute when users can not connect due to outages. In https://www.businesswire.com/news/home/20110510006495/en/At- a-Cost-of-More-Than-5000-Per-Minute-Data-Center-Outages-Can-Be- Painful-Emerson-Study-Shows

    work page arXiv

  2. [2]

    In https://smallbiztrends.com/2013/08/amazon-down-custom-error- page.html, 2013

    Amazon down 15 minutes, loses over $66,000 per minute. In https://smallbiztrends.com/2013/08/amazon-down-custom-error- page.html, 2013

    work page 2013

  3. [3]

    A comprehensive survey on internet outages.Journal of Network and Computer Applications , 113:36–63, 2018

    Giuseppe Aceto, Alessio Botta, Pietro Marchetta, Valerio Persico, and Antonio Pescapé. A comprehensive survey on internet outages.Journal of Network and Computer Applications , 113:36–63, 2018

    work page 2018

  4. [4]

    Improving coverage of Internet outage detection in sparse blocks

    Guillermo Baltra and John Heidemann. Improving coverage of Internet outage detection in sparse blocks. In Proceedings of the Passive and Active Measurement Conference, Eugene, Oregon, USA, March 2020. Springer

    work page 2020

  5. [5]

    Robert Beverly, Ramakrishnan Durairajan, David Plonka, and Justin P. Rohrer. In the IP of the beholder: Strategies for active IPv6 topology discovery. In Proceedings of the ACM Internet Measurement Conference , pages 308–321, Boston, Massachusetts, USA, October 2018. ACM

    work page 2018

  6. [6]

    Mea- suring and characterizing ipv6 router availability

    Robert Beverly, Matthew Luckie, Lorenza Mosley, and Kc Claffy. Mea- suring and characterizing ipv6 router availability. InPassive and Active Measurement: 16th International Conference, PAM 2015, New York, NY, USA, March 19-20, 2015, Proceedings 16 , pages 123–135. Springer, 2015

    work page 2015

  7. [7]

    Identifying impor- tant internet outages

    Ryan Bogutz, Yuri Pradkin, and John Heidemann. Identifying impor- tant internet outages. In 2019 IEEE International Conference on Big Data (Big Data), pages 3002–3007. IEEE, 2019

    work page 2019

  8. [8]

    Estimating internet address space usage through passive measurements

    Alberto Dainotti, Karyn Benson, Alistair King, KC Claffy, Michael Kallitsis, Eduard Glatz, and Xenofontas Dimitropoulos. Estimating internet address space usage through passive measurements. ACM SIGCOMM Computer Communication Review , 44(1):42–49, 2013

    work page 2013

Show all 41 references
  1. [9]

    Analysis of country-wide internet outages caused by censorship

    Alberto Dainotti, Claudio Squarcella, Emile Aben, Kimberly C Claffy, Marco Chiesa, Michele Russo, and Antonio Pescapé. Analysis of country-wide internet outages caused by censorship. In Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference, pages 1–18, 2011

    2011

  2. [10]

    Internet outage detection using passive analysis (poster abstract)

    Asma Enayet and John Heidemann. Internet outage detection using passive analysis (poster abstract). In Proceedings of the 22nd ACM Internet Measurement Conference, pages 772–773, 2022

    2022

  3. [11]

    Entropy/IP: Uncov- ering structure in IPv6 addresses

    Pawel Foremski, David Plonka, and Arthur Berger. Entropy/IP: Uncov- ering structure in IPv6 addresses. In Proceedings of the ACM Internet Measurement Conference, pages 167–181, Santa Monica, CA, USA, No- vember 2016. ACM

    2016

  4. [12]

    Strowes, Luuk Hendriks, and Georg Carle

    Oliver Gasser, Quirin Scheitle, Pawel Foremski, Qasim Lone, Maciej Korczyński, Stephen D. Strowes, Luuk Hendriks, and Georg Carle. Clusters in the expanse: understanding and unbiasing ipv6 hitlists. In Proceedings of the Internet Measurement Conference 2018, pages 364–378, 2018

    2018

  5. [13]

    Scanning the IPv6 internet: Towards a comprehensive hitlist

    Oliver Gasser, Quirin Scheitle, Sebastian Gebhard, and Georg Carle. Scanning the IPv6 internet: Towards a comprehensive hitlist. In Pro- ceedings of the, Louvain La Neuve, Belgium, April 2016

    2016

  6. [14]

    Chocolatine: Out- age detection for internet background radiation

    Andreas Guillot, Romain Fontugne, Philipp Winter, Pascal Merindol, Alistair King, Alberto Dainotti, and Cristel Pelsser. Chocolatine: Out- age detection for internet background radiation. In 2019 Network Traffic Measurement and Analysis Conference (TMA) , pages 1–8. IEEE, 2019

    2019

  7. [15]

    Editor-to-reader ratios on wikipedia

    Benjamin Mako Hill. Editor-to-reader ratios on wikipedia. blog post https://mako.cc/copyrighteous/editor-to-reader-ratios-on- wikipedia, February 2011

    2011

  8. [16]

    Blink: Fast connec- tivity recovery entirely in the data plane

    Thomas Holterbach, Edgar Costa Molero, Maria Apostolaki, Alberto Dainotti, Stefano Vissicchio, and Laurent Vanbever. Blink: Fast connec- tivity recovery entirely in the data plane. In 16th USENIX Symposium on NSDI 19, pages 161–176, 2019

    2019

  9. [17]

    Studying black holes in the internet with hubble

    Ethan Katz-Bassett, Harsha V Madhyastha, John P John, Arvind Krish- namurthy, David Wetherall, and Thomas E Anderson. Studying black holes in the internet with hubble. In NSDI, volume 8, pages 247–262, 2008

    2008

  10. [18]

    Lifeguard: Practical repair of persistent route failures

    Ethan Katz-Bassett, Colin Scott, David R Choffnes, Ítalo Cunha, Vy- tautas Valancius, Nick Feamster, Harsha V Madhyastha, Thomas An- derson, and Arvind Krishnamurthy. Lifeguard: Practical repair of persistent route failures. ACM SIGCOMM Computer Communication Review, 42(4):395...

    2012

  11. [19]

    is my inter- net down?

    Ege Cem Kirci, Martin Vahlensieck, and Laurent Vanbever. “is my inter- net down?” sifting through user-affecting outages with google trends. In Proceedings of the 22nd ACM Internet Measurement Conference, pages 290–297, 2022

    2022

  12. [20]

    About the Orion network telescope

    MERIT. About the Orion network telescope. web page https://www. merit.edu/initiatives/orion-network-telescope/, 2021

    2021

  13. [21]

    Voelker, and Stefan Sav- age

    David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Sav- age. Network telescopes: Technical report. Technical Report TR-2004- 04, UCSD CAIDA, July 2004

    2004

  14. [22]

    Target generation for internet-wide IPv6 scanning

    Austin Murdock, Frank Li, Paul Bramsen, Zakir Durumeric, and Vern Paxson. Target generation for internet-wide IPv6 scanning. In Pro- ceedings of the ACM Internet Measurement Conference , pages 242–253, San Diego, CA, USA, October 2017. ACM

    2017

  15. [23]

    Analyzing internet reliability remotely with probing-based techniques

    Ramakrishna Padmanabhan. Analyzing internet reliability remotely with probing-based techniques . PhD thesis, University of Maryland, College Park, 2018

    2018

  16. [24]

    How to find correlated internet failures

    Ramakrishna Padmanabhan, Aaron Schulman, Alberto Dainotti, Dave Levin, and Neil Spring. How to find correlated internet failures. In Passive and Active Measurement: 20th International Conference, PAM 2019, Puerto Varas, Chile, March 27–29, 2019, Proceedings 20 , pages 210–227....

    2019

  17. [25]

    Characteristics of internet background radiation

    Ruoming Pang, Vinod Yegneswaran, Paul Barford, Vern Paxson, and Larry Peterson. Characteristics of internet background radiation. In Proceedings of the 4th ACM SIGCOMM conference on Internet measure- ment, pages 27–40, 2004

    2004

  18. [26]

    Detecting internet out- ages with precise active probing (extended)

    Lin Quan, John Heidemann, and Yuri Pradkin. Detecting internet out- ages with precise active probing (extended). USC/Information Sciences Institute, Tech. Rep, 2012

    2012

  19. [27]

    Trinocular: Understand- ing internet reliability through adaptive probing

    Lin Quan, John Heidemann, and Yuri Pradkin. Trinocular: Understand- ing internet reliability through adaptive probing. ACM SIGCOMM Computer Communication Review, 43(4):255–266, 2013

    2013

  20. [28]

    When the internet sleeps: Correlating diurnal networks with external factors

    Lin Quan, John Heidemann, and Yuri Pradkin. When the internet sleeps: Correlating diurnal networks with external factors. In Proceed- ings of the 2014 Conference on Internet Measurement Conference , pages 87–100, 2014

    2014

  21. [29]

    Advancing the art of internet edge out- age detection

    Philipp Richter, Ramakrishna Padmanabhan, Neil Spring, Arthur Berger, and David Clark. Advancing the art of internet edge out- age detection. In Proceedings of the Internet Measurement Conference 2018, pages 350–363, 2018

    2018

  22. [30]

    http://www.root-servers.org, April 2016

    Root Operators. http://www.root-servers.org, April 2016. 14

    2016

  23. [31]

    IPv6 hitlists at scale: Be careful what you wish for

    Erik Rye and Dave Levin. IPv6 hitlists at scale: Be careful what you wish for. In Proceedings of the ACM SIGCOMM Conference , pages 904–916, New York, NY, USA, September 2023. ACM

    2023

  24. [32]

    Differences in monitoring the DNS root over IPv4 and IPv6

    Tarang Saluja, John Heidemann, and Yuri Pradkin. Differences in monitoring the DNS root over IPv4 and IPv6. pages 194–203, December 2022

    2022

  25. [33]

    Pingin’in the rain

    Aaron Schulman and Neil Spring. Pingin’in the rain. In Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference, pages 19–28, 2011

    2011

  26. [34]

    Disco: Fast, good, and cheap outage detection

    Anant Shah, Romain Fontugne, Emile Aben, Cristel Pelsser, and Randy Bush. Disco: Fast, good, and cheap outage detection. In 2017 Network Traffic Measurement and Analysis Conference (TMA) , pages 1–9. IEEE, 2017

    2017

  27. [35]

    AddrMiner: A compre- hensive global active IPv6 address discovery system

    Guanglei Song, Jiahai Yang, Lin He, Zhiliang Wang, Guo Li, Chenxin Duan, Yaozhong Liu, and Zhongxiang Sun. AddrMiner: A compre- hensive global active IPv6 address discovery system. In 2022 USENIX Annual Technical Conference (USENIX ATC 22), pages 309–326, 2022

    2022

  28. [36]

    Det: Enabling efficient prob- ing of ipv6 active addresses

    Guanglei Song, Jiahai Yang, Zhiliang Wang, Lin He, Jinlei Lin, Long Pan, Chenxin Duan, and Xiaowen Quan. Det: Enabling efficient prob- ing of ipv6 active addresses. IEEE/ACM Transactions on Networking, 30(4):1629–1643, 2022

    2022

  29. [37]

    Internet router outage measurement: An embedded approach

    Sejun Song and Jim Huang. Internet router outage measurement: An embedded approach. In 2004 IEEE/IFIP Network Operations and Management Symposium (IEEE Cat. No. 04CH37507) , volume 1, pages 161–174. IEEE, 2004

    2004

  30. [38]

    Ripe atlas: A global internet measurement network

    RIPE NCC Staff. Ripe atlas: A global internet measurement network. Internet Protocol Journal, 18(3), 2015

    2015

  31. [39]

    Cross language prediction of vandalism on wikipedia using article views and revisions

    Khoi-Nguyen Tran and Peter Christen. Cross language prediction of vandalism on wikipedia using article views and revisions. In Advances in Knowledge Discovery and Data Mining: 17th Pacific-Asia Conference, PAKDD 2013, Gold Coast, Australia, April 14-17, 2013, Proceedings, Part...

    2013

  32. [40]

    B-Root DNS service

    USC. B-Root DNS service. https://b.root-servers.org/

  33. [41]

    Passive outage data

    USC. Passive outage data. https://www.ant.edu/datasets/outage. APPENDIX A RESEARCH ETHICS Our work poses no ethical concerns. In evaluating the risks of or work relative to its benefits, it poses minimal risks, while there are significant benefits to a new method to detect Int...

    2019

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.