Understanding IP address multiplexing with large-scale SSL/TLS flow analysis

To better understand the Internet infrastructure services is crucial to the design, operation, and management of Internet applications. The lack of better understanding of the actual usage of allocated IP addresses is among many such challenges, due to the wide deployment of IP address multiplexing techniques, such as NAT. To address this issue, we propose a novel analysis approach based on large-scale SSL/TLS flow records of Apple and Amazon services in this paper. This method characterizes the behaviors of different types of multiplexing by three steps: grouping, dividing, and profiling. Our preliminary analysis shows several promising findings, e.g., encrypted data flows still reveals the valuable application behaviors; the multiplexing behaviors of mobile or wired Internet are quite different.