[LINK] IPv4 host density measured by ping

[Robin Whittle]

Hi Howard,

Thanks for your response:

> You can have static or dynamic IP with the modem in either routing mode
> (the norm nowadays with ping blocking also the norm) or in bridging mode
> (older DSL connections, esp. early Bigpond, and those that have been
> customised)

With a static IP address, I assume the modem is not responding to an IP
address, but the connected computer or router is, so it is the state of
that computer or router which matters.   If the typical arrangement is
for dynamic IP address and the modem also being a router, doing NAT,
then it would be up to the modem to respond to a ping or not.

If this is the usual case, with modems generally being set not to
respond to pings, then I don't understand why I get so many acks from
the prefixes I scanned.  I imagine an ISP would prefer ping responses to
be enabled in order to help monitor their network.

> 218.214.47.111

This prefix has reverse-mapped names in general of the form:

  218-214-47-xxx.people.net.au

except for a few such as yours.   I got 55 Acks (21%) from this prefix.

It is hard to tell how many of those services are really used.  Maybe
most of the addresses are used, and most of them have ADSL modems with
their ping responses turned off.  I guess yours is a static IP address
service, so maybe the rest of the prefix is used for static services too.

I accept that some ADSL modems and other routers and computers do not
acknowledge pings, but in the absence of any other method, I still think
ping responses give some indication of how well address space is being
used, in general.

Of course, a particular network might have no ping responses at all and
still be using many of its IP addresses.  One way of investigating this
is to find the reverse mapped names for the whole /24 and check if those
names resolve to the same IP addresses.  That would be a pretty good
indication that the operator was serious about using the space, unless
of course the names were just a numeric sequence, rather than indicative
of particular computers being on particular IP addresses.  Also, if I
could find a web server in those names, and get a page from it, that
would prove that at least that address was in use.  I don't feel like
probing a bunch of addresses for SMTP, HTTP, SSH responses etc. because
that looks unfriendly.

I have been doing this reverse mapping lookup of /24s which did not
respond to pings.  I wrote a program to do the entire 256 addresses - it
takes a while and it will be a while before I write up the results.


  - Robin