Applications IPs vs Application Stats

Application IPs vs Stats

The Netify Applications IPs and Application Stats datasets are similar but designed for two different purposes.

At A Glance

Application IPs

The Application IPs dataset is a network-centric solution that is typically used for:

Firewall rules
Quality of service (QoS)
Network routing policies
Denylisting/safelisting

The dataset provides compact network blocks and IP lists for every application supported by Netify.

Example Use Case: Cybersecurity solutions safelist IPs and networks for high-volume applications like YouTube, Netflix, and others. This safelist makes it possible to focus computing resources on unknown IPs and networks.

Application Stats

The Application Stats dataset is a very detailed data solution that is typically used for:

Investigating application behavior
Analyzing protocol and port patterns
Extending app-based machine learning models
Enhancing existing network feeds

The dataset provides detailed information on IPs, networks, and protocol/port statistics. Typically, the data is analyzed for a deeper understanding of application behavior.

Example Use Case: The additional information in the Application Stats dataset makes it possible to distinguish between Netflix video streaming and non-video streaming IPs.

A Closer Look

Let's take a deeper dive by looking at an example dataset from Quad9. Quad9 is a global public DNS service that aims to protect users from malware and phishing. To start, both the Application IPs and Stats datasets provide a list of networks (CIDRs) that are dedicated to delivering Quad9 services:

9.9.9.0/24
68.65.126.0/23
149.112.112.0/24
149.112.149.0/24
199.249.255.0/24

So far, so good. From here, the two datasets provide different views of the Quad9 application. We'll start with the Application IPs dataset.

Application IPs

Outside of the networks listed above, Quad9 uses a handful of IP addresses on 3rd party networks. These IP addresses are not contiguous - just a bunch of IPs scattered around the Internet. In the Application IPs dataset, these IPs do not overlap with the Quad9 networks (CIDRs) listed above. Here are the two third-party IPs:

205.207.155.37
216.21.3.77

A network administrator could use the network and IP data to prioritize Quad9 DNS traffic out a high-speed low-latency network.

Please keep in mind the Quad9 data is a simple example. It is not unusual to see hundreds or even thousands of IPs in an application dataset. In fact, it is very common to see a very large number of non-contiguous IPs for:

Content delivery (CDNs)
Cloud hosting
Mail services
Advertising engines
Authentication solutions

Example Application IPs list for the Quad9 application:

"ip_list": [
    {
        "address": "205.207.155.37",
        "version": "ipv4",
        "shared_score": 3
    },
    {
        "address": "216.21.3.77",
        "version": "ipv4",
        "shared_score": 3
    }
]

Application Stats

The Application Stats dataset provides a much more detailed view of an underlying application. First, the IP lists in the dataset provide information on all active IPs, including those on Quad9 network ranges.

For example, on the Quad9 9.9.9.0/24 network (CIDR), there are 5 IPs that are active:

9.9.9.9
9.9.9.10
9.9.9.11
9.9.9.12
9.9.9.13

The Application Stats dataset has information on reverse DNS, primary TLS certificate hostname, ASN information, country, platform information (e.g., AWS), shared score, and more. Please see the IP Property documentation for details.

Application Stats provides detailed information on all active IPs used by Quad9. Sample IP information for 9.9.9.9 is shown below.