Internet Infrastructure: Paper Session Summary

In an effort to share ideas beyond the limited time we have during the annual conference, the Community Building Committee asked Graduate Students attending TPRC54 to take notes of paper sessions to be made available to the community. The following is a summary of the paper session entitled “Internet Infrastructure” that was presented on Saturday, September 26, 2026 at 9:00am. The session was moderated by Karen Collins, MIT. The following is an edited summary based on the notes provided by Deepak Gouda, Georgia Institute of Technology. Full papers can be accessed through ConfTool.

Paper 1: “On IP Addresses as Identifiers of Internet Users and Services”

Rumaisa Habib, Stanford University; Sudheesh Singanamalla, Independent; Marwan Fayed, Cloudflare; Zakir Durumeric, Stanford University

In past organizational and governmental efforts to curb malicious activity, blocking IP addresses has been a primary tactic. However, this approach frequently causes significant collateral damage because a single IP address is often shared among multiple entities. To understand the scale of this issue, the study investigates the extent to which IP addresses are shared among users and services through mechanisms such as Network Address Translation (NAT), Carrier-Grade NAT (CGNAT), virtual private networks (VPNs), and proxies.

The empirical findings highlight how pervasive IP address sharing is across modern internet infrastructure. Data from Cloudflare reveal that just 5% of IP addresses account for 55% of all incoming requests, with a single IP address observed serving more than 7,000 distinct user agents. Furthermore, only 0.2% of domains maintain a unique, one-to-one mapping to an IP address. An investigation into the underlying causes found no statistically significant correlation between IP address sharing and dominant cloud providers, mobile carriers, or historical address allocation patterns. This suggests that address reuse is a structural feature of internet infrastructure rather than a phenomenon tied to specific network types.

Because IP address sharing has become standard practice in the technology industry, these findings demonstrate an urgent need to reassess the effectiveness and consequences of IP-based blocking and develop alternative methods of online attribution. A critical disconnect remains between technical realities and governance: while the engineering community is well aware of widespread IP address sharing, this understanding has not translated into policy, and policymakers continue to rely on IP addresses for legal and regulatory identification.

Paper 2: “Dissecting the Cost of Peering: Evidence from Global Data on IXPs”

Amreesh Phokeer, Internet Society and Anirudh Tagat, Internet Society

Peering keeps internet traffic local, creating a robust ecosystem that significantly improves connectivity and reachability. However, evaluating its true value requires analyzing the underlying pricing structures. While traditional IP transit costs are billed on a variable USD/Mbps/month basis, peering expenses include flat port fees (which account for 44% of the total cost), transport fees, and colocation charges.

Beyond direct financial benefits, peering offers key operational advantages, such as eliminating tromboned routing, reducing reliance on international transit, attracting localized traffic, and creating stronger economic incentives. To determine whether peering is genuinely more cost-effective and beneficial, the study explores two main research questions: How do the costs of peering and IP transit compare for a given volume of Mbps? What is the broader economic impact of peering on telecommunications markets?

To address these questions, the research draws on data from Peering Exposed (crowdsourced pricing), TeleGeography, operator surveys, Packet Clearing House traffic volumes, and the Internet Society's Internet Resilience Indicator. It also measures peering intensity using the ratio of internet exchange points (IXPs) to autonomous system numbers (ASNs) within a country.

By calculating unit cost savings as the difference between IP transit and peering costs, the analysis reveals that IP transit prices are typically hundreds of times higher than peering prices, although the two rates are nearly identical in mature markets such as the Netherlands.

These cost savings are associated with positive effects across several telecommunications metrics:

• Broadband prices: Decrease for end consumers.

• Mobile coverage: Expands across regions.

• Telecommunications revenue: Increases overall.

• Average revenue per user (ARPU): Remains flat, driven by an expanded user base.

Developing nations, particularly low- and middle-income countries, benefit the most from peering. This is especially true for countries that rely heavily on expensive international links, where local traffic previously had to leave the country to reach its destination.

Ultimately, further research is needed to fully understand this cost differential, as lower peering costs may come with trade-offs in service quality or capacity. Furthermore, as successful internet exchange points (IXPs) raise their fees, many entities are increasingly turning to private, settlement-free peering arrangements.

Paper 3: “Treaty Obligations Without Recognition Capacity: The Sendai Framework and Compound Infrastructure Attacks in the High North”

Patricia Vargas Leon, Indiana University; Szymon Skalski, Jagiellonian University, Poland; Jorge Acevedo Canabal, Indiana University

This proposal highlights the escalating threat of infrastructure attacks in the High North, focusing on the strategic vulnerabilities of the Svalbard archipelago. Despite the 1920 Svalbard Treaty’s prohibition of warlike activities in the region, Svalbard’s critical infrastructure remains uniquely exposed. The archipelago relies on two subsea communications cables that share a single landing point and power supply. It also hosts key international facilities, including the SvalSAT satellite ground station and critical GPS signal infrastructure.

In 2022, a series of suspicious events unfolded across different domains: a subsea cable failed in January and was classified by police as an accident; the AcidRain wiper malware disabled tens of thousands of Viasat modems in February and was treated as a cyberattack; and widespread GPS jamming occurred throughout the year and was classified as electronic interference.

A major systemic vulnerability is that these incidents were handled in isolation by separate agencies. Governed by five overlapping regulatory regimes, the region currently lacks a single entity responsible for aggregating and analyzing these events collectively. Consequently, a coordinated campaign involving several separate disruptions—each targeting a different system and timed to work in tandem—could easily be misclassified as a series of unrelated accidents or minor operational issues.

To address this structural blind spot, the proposal advocates using the UN’s 15-year Sendai Framework for Disaster Risk Reduction to bridge the gap between international law and disaster science. By establishing a collaborative framework, key stakeholders could work together to map threats across multiple domains:

• UNDRR and ISC: Expand and standardize the vocabulary used to describe complex, compound disaster risks.

• IAEG-DRS: Connect seemingly isolated events across technical, cyber, and physical sectors.

• Norway: Maintain and centralize incident records.

• Industry and insurers: Provide real-time evidence and operational data.

By aggregating information about these distinct events, this interdisciplinary approach could make distributed, low-intensity attack patterns visible. The ultimate takeaway is clear: the primary vulnerability lies in gaps in governance and analysis, and formally recognizing these coordinated tactics is a crucial first step toward enabling an effective response.