Towards Understanding Middlebox Deployments in Dutch ASes: Impact of IP Sampling Size

SYNOPSIS Middleboxes are pervasive network elements that modify, delay, or drop network packets. Understanding their deployment within Autonomous Systems (ASes) enhances transparency, secure operations, and informed routing. However, detecting middleboxes at scale remains challenging when scanning network prefixes, due to the limited coverage of address space per prefix. In this preliminary study, part of a broader investigation into middlebox deployment in Dutch ASes, we use Yarrpbox to examine how the number of sampled IPs per prefix affects detection. By varying per-prefix sampling, we evaluate the resulting number of detected middleboxes, their network locations, and reachability. Results show larger samples yield more detections and higher responsiveness, with diminishing returns beyond 600 IPs per prefix. Moreover, our initial analysis reveals 56% of middle-boxes are located in hosting providers.