An Internet-wide view of CG-NAT and Large-scale IP Sharing | Cloudflare Research | LACNIC 43 скачать в хорошем качестве

An Internet-wide view of CG-NAT and Large-scale IP Sharing | Cloudflare Research | LACNIC 43

My talk at LACNIC 43 (Latin America and Caribbean Network Information Centre) on how at Cloudflare we try to identify CG-NAT IPs at Cloudflare to improve IP-based traffic filtering. Abstract: The presentation examines collateral damage in IP‐based security due to large‐scale IP sharing (LSS) from Carrier-Grade NAT (CGN) and VPN/proxies; indiscriminate blocklists, rate-limiting, and anomaly detection can penalize legitimate users sharing IPs . To address this, we compile labeled CGN, VPN/proxy, and non-LSS IPs via RIPE Atlas traceroutes, WHOIS, and DNS PTR records, extracting features including User-Agent diversity, TLS fingerprints, port distributions, and RTT variability . An XGBoost classifier achieves a 97% F1-score and 98% accuracy, with /24-level features most predictive . They find CGN IPs generate 16× more requests and are three times likelier to be rate-limited despite similar bot scores. Global analysis shows highest CGN volumes in Brazil, India, and the US, and greatest proportional impact in Africa and Southeast Asia. Conclusions emphasize that detecting multi-user IPs via feature diversity is essential for equitable security and encourage community collaboration to refine detection and filtering. Slides: https://apievt.lacnic.net/wp-content/... Event: https://lacnic43.lacnic.net/en #cloudflare #security #networking ----------------------------------- X: https://x.com/@GVasilis Bluesky: https://bsky.app/profile/giotsas.com GitHub: https://github.com/vgiotsas Google Scholar: https://go.giotsas.com/publications