@evan I once read a paper about estimating IP addresses in use using a method for environmental surveys called “capture-recapture” https://en.wikipedia.org/wiki/Mark_and_recapture.
The idea being that you sample a population, and you tag it. Then, as you go, you count which samples are already tagged when you pick them up again.
In the IP evaluation (https://researchportal.murdoch.edu.au/esploro/outputs/conferencePaper/Estimating-IPv4-address-space-usage-with/991005540977007891), IIRC, they were tagging the packets by just recording them, and recapturing them by sniffing from different vantage points.
I'm still fascinated by it, and wish I had somewhere to try to apply it to. Perhaps this may be useful for you?