how to find age of IP

Helo everyone :-),
I am toying with an interesting thought and
was hoping some more experienced people here could perhaps give me a
pointer. Actually it would even be helpful if someone could help
phrase the question in a better way too.

the problem: I want to know the age of an IP

Details: By age I mean when, has this IP been used to communicate in
the Internet during the past 5/10/15 days etc..

How can I do this: One way to do it would be to analyze trace logs
from various vantage points in the Internet (provided I can get my
hands on a bunch of non-anonymized traces which is very very hard)

Another way to do this would be to do a whois for the site hosted on
that IP and see the created on, updated on fields. This would provide
some idea of when was this IP used and last-used by the owner. Of
course, 1 IP can be shared by many sites and the word"used" can have
more than one meaning, such as, when was the site hosted n that IP
last modified. This can be found via the Internet archive (hopefully).

I am thinking of understanding whether IPs are used consistently or
whether some IPs lie dormant for some time..something interesting. I
hope this made some sense. Any pointers and suggestion, links to
papers are very appreciated. I tried searching for these terms but did
not land at something meaningful.

Comments are welcome :-)
Thanks,
-A

On Fri, 16 May 2008 12:53:43 -0700, newbiegalore wrote:

> the problem: I want to know the age of an IP
[..]
> Comments are welcome :-)

How old is an unlisted phone number, when was it used the last time, by
whom, to call whoever? ;-P

If missing your point, this may be a good start..:
http://www.iana.org/


--
Regards/mvh Joachim Mæland

If everything seems under control, you're just not going fast enough.
-Mario Andretti

On Fri, 16 May 2008, in the Usenet newsgroup comp.os.linux.networking, in
article <1a71bbb6-a9cc-4e32-bd92-(E-Mail Removed)>,
newbiegalore wrote:

NOTE: Posting from groups.google.com (or some web-forums) dramatically
reduces the chance of your post being seen. Find a real news server.

> I am toying with an interesting thought and
>was hoping some more experienced people here could perhaps give me a
>pointer. Actually it would even be helpful if someone could help
>phrase the question in a better way too.

Perhaps if you explained what is the final goal.

>the problem: I want to know the age of an IP
>
>Details: By age I mean when, has this IP been used to communicate in
>the Internet during the past 5/10/15 days etc..

You may want to narrow the numbers that you are looking for. As of
Thursday evening, there were 86251 IPv4 networks active in the world,
totalling 2,648,053,472 addresses, and that does not include systems
using RFC1918 addresses. If you include the 2462 IPv6 networks, you
add about 5723 x 10e30 addresses. Assuming you keep data on each
address, you've got an enormous amount of data to sift through.

>How can I do this: One way to do it would be to analyze trace logs
>from various vantage points in the Internet (provided I can get my
>hands on a bunch of non-anonymized traces which is very very hard)

Never mind being an awesome amount of data at each vantage point.

>Another way to do this would be to do a whois for the site hosted on
>that IP and see the created on, updated on fields. This would provide
>some idea of when was this IP used and last-used by the owner. Of
>course, 1 IP can be shared by many sites and the word"used" can have
>more than one meaning, such as, when was the site hosted n that IP
>last modified.

You're also assuming that every IP is running a web server of some kind.
Nothing could be further from the truth. The web is one of hundreds of
different services running on the Internet. It is NOT the only one.

>This can be found via the Internet archive (hopefully).

Sure - all search engines have a few Exabytes of stuff archived ;-)

>I am thinking of understanding whether IPs are used consistently or
>whether some IPs lie dormant for some time..something interesting.

Of the addresses used for commercial (non-residential) services, you
will find a significant number connected and running. But determining
what those numbers might be is going to be difficult at best.

1. ICANN lists over 1050 registrars world wide.
2. There are 20 top level domains like .com or .biz
3. There are 246 national top level domains, like .ac, .in or .zw
(while most of these national top level domains are registering
domains, not all of them operate whois servers).
4. There is no single reliable database of domain names[1]

>I hope this made some sense. Any pointers and suggestion, links to
>papers are very appreciated. I tried searching for these terms but
>did not land at something meaningful.

You're going to have to come up with a better definition of exactly
what you are trying to determine and maybe why you think the info
might be useful/entertaining/available.

Old guy

[1] When you use DNS to look up a domain name, the name server chain
starts with the root servers. They know about the 260+ top-level domain
name servers, and refer you to the appropriate one. Root servers don't
know about domains, and a top-level domain server knows about the domains
it is responsible for, but not 'others' in the world.