Scanning the IPv6 internet: Towards a comprehensive hitlist

Oliver Gasser, Quirin Scheitle, Sebastian Gebhard, Georg Carle

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

50 Scopus citations

Abstract

Active network measurements constitute an important part in gaining a better understanding of the Internet. Although IPv4-wide scans are now easily possible, random active probing is infeasible in the IPv6 Internet. Therefore, we propose a hybrid approach to generate a hitlist of IPv6 addresses for scanning: First, we extract IPv6 addresses from passive flow data. Second, we leverage publicly available resources such as rDNS data to gather further IPv6 addresses. Third, we conduct traceroute measurements from several vantage points to obtain additional addresses. We perform multiple active measurements on gathered IPv6 addresses and evaluate response rates over time. We extensively compare all IPv6 address sources. In total we found 150M unique IPv6 addresses over the course of four weeks. Our hitlist covers 72% of announced prefixes and 84% of Autonomous Systems. Finally, we give concrete recommendations to maximize source efficiency for different scan types.

Original languageEnglish
Title of host publicationTraffic Monitoring and Analysis - 8th International Workshop, TMA 2016
PublisherInternational Federation for Information Processing, IFIP
ISBN (Electronic)9783901882920
StatePublished - 2016
Event8th International Workshop on Traffic Monitoring and Analysis, TMA 2016 - Louvain la Neuve, Belgium
Duration: 7 Apr 20168 Apr 2016

Publication series

NameTraffic Monitoring and Analysis - 8th International Workshop, TMA 2016

Conference

Conference8th International Workshop on Traffic Monitoring and Analysis, TMA 2016
Country/TerritoryBelgium
CityLouvain la Neuve
Period7/04/168/04/16

Fingerprint

Dive into the research topics of 'Scanning the IPv6 internet: Towards a comprehensive hitlist'. Together they form a unique fingerprint.

Cite this