What I Learned at TMA: Exploring New Frontiers in Network Measurement

I recently attended and presented at the TMA Conference in Copenhagen (June 10 to 13), one of the key gatherings for researchers and practitioners working on traffic measurement and analysis. The experience was both fascinating and practically relevant for the kind of work we do at IPinfo. 

Here are some highlights from the conference and a few ideas I brought back that could inform our own data research and product strategy.

Mapping the Internet Through IPv6: Lessons from Starlink

Some of the standout research we encountered explored the OneWeb satellite network. The same research group also presented a poster at the conference where they compared OneWeb to Starlink. In addition they also explored Starlink’s use of IPv6 and the implications for network topology discovery. While Starlink users are behind CG-NAT in IPv4, in the IPv6 space their routers are globally routable and reachable. The authors identified over 3 million IPv6 addresses belonging to user routers by probing the ::1 address of each /56 subprefix listed in Starlink’s geofeed.

I ran a quick test scan on a /40 prefix covering Seattle and found a hit rate of over 50%, with more than 38,000 responsive IPv6 addresses. Most of these aren't in existing hit lists, which makes this a valuable opportunity. For IPinfo, this kind of probing could help us:

• Perform latency measurements for geolocation inference for finer granularity than Starlink's geofeed (which is at country level for most countries and state level for the US)
• Find additional addresses to apply the "satellite" tag to

VPN Detection, Distributed Systems, and More

Several sessions touched directly on topics relevant to our research. A few that stood out:

• VPN Traffic Identification: Tanmay Rajore presented a paper on fingerprinting VPN traffic, and we discussed the potential of using APIs to directly retrieve VPN exit node IPs. It’s an avenue worth exploring for more real-time, flexible tagging.
• UDP Scanners & VPN-based Measurements: There were posters on network scanning behavior, including UDP-based scanners and techniques using VPN servers for vantage points. These are both areas we could incorporate into broader research or enrich our detection capabilities.
• FireHOL Blocklists: One paper referenced FireHOL lists, which include VPNs. We may want to revisit those datasets for potential enrichment or cross-verification.
• DNS Data Corpus: There was a presentation from the University of Wisconsin that made me think we could look into collecting OpenINTEL DNS data as well.
• Distributed Storage System Crawls: There was an interesting session about crawling distributed storage systems — and it turns out they’re using IPinfo data already. This could be a good fit for future crawling experiments on our end.

Presenting Our Research, Building Relationships

In addition to taking in all the other impressive research, I gave a talk at TMA highlighting our academic research program, internship program, and the probe servers at universities program.

One of the best parts of TMA was the chance to meet researchers using, or hoping to use, our data. I had a great conversation with Joshua Levett from the University of York, who’s working on mapping companies using WHOIS and PeeringDB data. He’s since applied to IPinfo’s Academic Research Program, which is always exciting to see.

I also connected with Emile Aben from RIPE NCC, who’s working on a visualization of ASes around the globe using IPinfo data. We’ve already started following up on how we might support that project.

Sharing Data

There’s growing interest in our dataset from people doing real-world measurement work — and several researchers even asked about hosting probe servers. These kinds of relationships are important, not just for community engagement, but also because they lead to new ideas and new uses for our data.

Interested in hosting a probe server at your university? Reach out to us.

Looking Ahead

TMA reinforced how much opportunity there is in network measurement. Whether it’s mapping Starlink, identifying VPN behavior, or powering new types of academic research, there’s an appetite for high-quality, ground-truth network data, and IPinfo is well positioned to help.

If you're interested in the details of any of these papers or want to discuss how we might apply these ideas internally, I’d be happy to share more. Let’s keep the momentum going.