Nodes
A node represents an IP address observed during traceroute. It does not necessarily represent an entire router or device. A physical router may have multiple addresses, and the same address may appear in many measurements.
Internet Report / Research and Methodology
Understanding the Internet Maps.
Internet Report explores how networks appear when observed from distributed measurement points around the world. Using traceroute measurements, the project builds visual representations of the routing paths encountered while probing address space associated with different countries and territories.
These maps are not geographical diagrams or complete inventories of Internet infrastructure. They are visual representations of measured paths, captured at particular times and from particular locations.
What are we actually mapping?
The Internet is not one single network. It is a collection of independently operated networks interconnected through routing agreements, transit providers, exchanges and other infrastructure.
Internet Report uses traceroute to observe some of those connections. By sending probes with progressively increasing hop limits, traceroute attempts to identify intermediate routers between a measurement point and a destination.
Each responding address becomes part of our measurement dataset. Repeated observations help reveal patterns in the visible routing structure.
The resulting maps are network graphs rather than conventional geographical maps.
Reading the atlas
What do the shapes mean?
Connections
Lines represent relationships inferred from consecutive responding hops in recorded traceroutes. They do not necessarily represent individual physical cables or direct geographical connections.
Long chains
Long chains show sequences of observed routing addresses. They may represent transit paths, access networks or other routing structures visible to the probes.
Fan shapes
A fan or dandelion-like structure appears when many observed paths share a common address before branching towards different destinations.
This can be consistent with aggregation or shared routing, but does not by itself identify a particular router type.
Dense clusters
Dense collections of nodes and edges can indicate many repeatedly observed routing relationships.
They may also be influenced by how traceroute handles load-balanced networks or how observations are combined into a graph.
Diamond and lattice shapes
Diamond and mesh patterns may indicate alternative paths or equal-cost multipath routing.
Traditional traceroute can also produce misleading connections when successive probes follow different load-balanced paths. These structures require further measurement before they can be interpreted confidently.
Disconnected fragments
Small disconnected groups are not necessarily isolated networks.
Routers may ignore traceroute probes, rate-limit their responses or hide intermediate hops. Missing responses can split an otherwise continuous measured path into separate visible fragments.
Loops
Small loops can arise when the same address appears at successive hop positions, from routing behaviour, or from how the graph is constructed.
A visible loop should not automatically be interpreted as a real network routing loop.
Disconnected components
A connected component is a group of nodes joined by observed graph edges.
A country can have many components because of incomplete responses, different probe paths and limitations in the available measurements.
What do the colours mean?
Colours provide visual separation within the rendered network diagrams.
The precise meaning of each colour depends on the current rendering configuration. Until an explicit colour legend is published for a map, colours should not be interpreted as identifying particular Internet service providers, autonomous systems or physical locations.
Future versions may use autonomous system information to identify networks and distinguish their observed relationships more clearly.
What does a country represent?
Countries and territories are used to organise measurement campaigns.
Destinations are selected from IP address ranges associated with a particular country or territory in allocation data. This does not establish where the responding equipment is physically located.
For example, a router operating in one country can use an address allocated or registered elsewhere. Likewise, an address associated with a country does not guarantee that the device using it is located there.
These maps should therefore be understood as observations towards country-associated Internet address space, rather than literal maps of national infrastructure.
Measurement process
How the data is collected
1. Select destinations
Country campaigns select destination addresses from country-associated IP address allocations. Large campaigns can generate targets progressively rather than creating the entire work queue at once.
2. Distribute work
A central management system distributes targets to collectors. Multiple collectors can operate from different network locations.
3. Run traceroutes
Each collector performs traceroute measurements and records the addresses and responses observed along the route.
4. Store observations
Results are returned to the central database. Repeated observations can help identify commonly encountered addresses and routing relationships.
5. Build network graphs
The rendering system uses the collected measurements to construct a graph of responding addresses and observed hop relationships.
6. Generate the atlas
Country maps are rendered periodically as measurements accumulate. The resulting images provide snapshots of the visible topology at different stages of collection.
Understanding the statistics
Completed IPs: The number of campaign targets processed by the collection system. This is not a count of Internet devices or unique routers discovered.
Traceroutes: The number of trace records associated with the campaign.
Nodes: The number of graph nodes reported by the latest render. These represent observed network addresses, not necessarily unique physical devices.
Edges: The number of graph connections reported by the render. These represent observed or graph-derived hop relationships rather than verified physical links.
Core and transit: The current renderer reports categories based on addresses associated with the selected country and other addresses encountered along measured paths. They should not be treated as verified geographic or network-role classifications.
Campaign progress: The proportion of campaign work reported as completed. A completed campaign does not mean that every network or router in the country has been discovered.
Why measurements can be incomplete
Traceroute depends on responses from intermediate network equipment. Some routers do not respond at all. Others filter probes, limit response rates or return different addresses depending on routing conditions.
Network address translation, tunnels, firewalls, load balancing and asymmetric routing can also affect what the measurement system observes.
Different collectors may see different routes towards the same destination.
A missing connection in one of our maps is therefore not evidence that two networks cannot communicate. Equally, a visible edge does not prove a dedicated physical connection exists between two routers.
Load balancing and measurement artefacts
Modern networks frequently distribute traffic across multiple paths using techniques such as equal-cost multipath routing (ECMP).
Classic traceroute may vary packet characteristics between probes, causing those probes to follow different load-balanced paths.
When those responses are combined into a single graph, the result may contain diamond or lattice patterns that exaggerate the apparent connectivity.
Flow-stable tracing techniques, sometimes called Paris-traceroute-style measurements, can reduce some of these artefacts.
These methods are a potential area for future collection improvements and are not assumed to have been used for every existing observation.
Historical value of the project
Internet Report is intended to be more than a collection of attractive network diagrams.
By preserving measurements over time, the project can support research into changes in observed network connectivity, routing behaviour, frequently encountered addresses and autonomous system relationships.
A sequence of maps may reveal structural changes, but any apparent change must be interpreted alongside measurement coverage, probe location and collection method.
The aim is to create a useful historical record of how the Internet appears from our measurement points.
Future improvements
Areas of ongoing investigation include better handling of unanswered hops, filtering graph artefacts, flow-stable traceroute collection, autonomous system enrichment and improved visualisation of connected components.
Further measurement-quality statistics may help readers distinguish between network structure and limitations of the collected evidence.
As the system develops, the project aims to preserve the original measurement records while improving their interpretation and presentation.
Important research disclaimer
All maps are experimental observations, not definitive representations of national Internet infrastructure.
They should not be used on their own to establish physical geography, network ownership, resilience, reachability or the existence of particular links.
The project provides a view of what its probes observed, subject to the limitations of traceroute and the available measurement coverage.