The Size of The Internet

January, 2014

Bruce Ediger

Between 2011-10-25T15:23:55-06 and 2013-09-27T20:32:44-06 I ran p0f version 2, a passive operating system identification program. p0f listens for the first, SYN, packet of the famous 3-way TCP handshake that begins a TCP connection. It examines SYN packets for characteristics particular to certain TCP/IP implementations. One of the things p0f can sometimes determine is how many router hops away the SYN packet comes from.

Over two years, I collected 4,524,045 SYN packets. Of those, p0f could determine hop count for 1,673,149 packets. The graph below shows the proportion of packet counts versus the actual hop count.

Router hops histogram

2% of packets have a hop count of zero, probably from me logging in to the server from the same subnet. 1% of packets have a hop count of 1, probably from me logging in via my wireless access point. Only 2 packets had a hop count of 2, and 12 packets have a hop count of 3. I think this is because my LAN is connected to the Internet by ADSL, which means a PPP connection over the twisted pair to the Central Office. Entities with hop counts of 2 and 3 are the phone company's end of the PPP connection, and a router for their DSL customers. Three packets, all from someplace in Brazil, had a hop count of 40.

As far as the size of the Internet, if my server resides at the center of the Internet, then the Internet is 80 router hops from edge to edge. This seems unlikely. Given my DSL connection, my router probably lives at the edge of the Internet. Other edge-located would lie both closest and farthest away. Observation of the 5-hop-away Internet Protocol addresses confirms the "edge nodes closest" part. The high proportion of SYN packets at 21 and 25 hops seem to be from geographic locations far away from mid-North America. In conjunction with the other spikes at 8, 9, 13 and 17, I think this argues for a multi-locality Internet. That is, many blobs of end nodes exist, with sets of routers only between the blobs. Only the local sizes really mean anything, and in the graph above that's the 5-hop proportion.