Rethinking Address Reality: IPv4 Utilisation and Proxy Network Exposure in Australia#

Aftab Siddiqui - APNIC Foundation

• Why: Two halves, both valuable: ground-truthing Australian IPv4 holdings/geolocation (registry data vs reality), and a genuinely novel measurement of residential proxy networks — including a NetFlow-based detection technique consumer ISPs can deploy today. The proxy half is a network-security problem that lands on operators' laps.
• What: Part 1: NRO delegation data shows Australia actually holds ~45.9M IPv4 addresses (179K /24s, 9,867 delegations) vs what APNIC REX presents; transfer analysis shows Australia is a net exporter of IPv4 (net −500 transfers / −2.1M addresses over ten years). Only 5.3% of AU delegations publish RFC 8805 geofeeds (94.7% silent), with common breakage (GitHub blob URLs returning HTML, dead URLs); cross-checking commercial (IPinfo) vs geofeed data shows 99.97% country agreement but only ~80.5% city agreement, with commercial data biased toward capitals. Part 2: instrumented five residential proxy providers (Oxylabs, IPRoyal, FloppyData, Shifter, Bright Data) with ~500K requests, 28,217 unique exit IPs across Sydney/Melbourne/Brisbane: 2,747 IPs appeared in ≥2 providers (Oxylabs–Shifter overlap largest at 1,375); exits concentrate in consumer ASNs (Telstra 6,668, TPG 4,776, Optus 3,099, Aussie Broadband 2,571, Starlink 1,925); and TCP timestamp-rate fingerprinting (fitting TSval slope within connections) clustered exits into ~1000/300/250/100 Hz families (70.8% at ~1000 Hz) — a device-class signal the proxy relay cannot fake because the exit's own kernel builds the segments. The exits never fetched any sub-resource (zero of five tracking pixels loaded).
• How: Per-provider hostnames + per-request tokens to join client and server logs; SYN pcap analysis (TTL, MSS, window, TCP option order); timestamp-rate fitting requiring ≥3 samples over 250 ms; browser fingerprint page. Operator guidance: proxy SDKs hold persistent outbound connections from consumer CPE to a small set of gateways — visible in NetFlow as long-lived flows to the same destinations from thousands of unrelated subscriber lines, no DPI needed.
• Where applicable: The dataset and geofeed findings are Australia-specific; the measurement methodology and the NetFlow detection guidance transfer to any consumer ISP. Provider device-count claims quoted from vendor marketing are explicitly unverified.