One IP address, many users: Detecting CGNAT to reduce collateral effects

This post introduces Cloudflare's work on detecting Carrier-Grade NAT (CGNAT) and other large-scale IP sharing (LSS) mechanisms. It highlights the socioeconomic bias that can arise from traditional IP-based security measures when applied to shared IPs, particularly in developing regions. The post details the motivation for this work, the technical challenges of CGNAT, and Cloudflare's approach to building a supervised learning classifier using distributed traceroutes and public data sources to identify CGNAT IPs. This contributes to the broader theme of refining threat management by understanding the underlying network infrastructure and user access patterns.