Identifying Low-ProfileWeb Server's IP Fingerprint

With the immense success of World Wide Web, Web servers have become ubiquitous for all kinds of organizations, even for individuals. While most previous research has been conducted on high-profile Web servers, the majority of Web servers on the Internet are low-profile. In this paper, we focus on the low-profile Web servers inside a middle-sized campus network. We collect eight-month traces on ten departmental Web servers and investigate the dynamics of IP addresses of their remote clients. After analyzing accesses of remote clients to the monitored servers, we find that (1) the pool of 32-bit IP addresses seen by a server rarely converges to a stable set, i.e., there are always a large portion of unseen 32-bit IP addresses sighted in each weekly trace; (2) however, the group of frequent visitors to a server is relatively stable, and a simple clustering by 24-bit IP prefix further confirms this observation; (3) although the portion of frequent visitors is small, the volume of requests they issue dominates in total; (4) last but not least, each Web server has its own group of loyal clients excluding Web crawlers. We call such a relatively stable and unique pool of “loyal” clients for each low-profile Web server its IP fingerprint.