Clusters in the Expanse

Gasser, Oliver; Scheitle, Quirin; Foremski, Paweł; Lone, Qasim; Korczyński, Maciej; Strowes, Stephen D.; Hendriks, Luuk; Carle, Georg

doi:10.1145/3278532.3278564

Cited by 92 publications

(44 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In IPv6, however, the exhaustive scan of the routable space is not feasible. Instead, we scan more than 445 million hosts from the IPv6 Hitlist Service [17].…”

Section: Internet-wide Scansmentioning

confidence: 99%

Routing Loops as Mega Amplifiers for DNS-Based DDoS Attacks

Nosyk

Korczyński

Duda

2022

Passive and Active Measurement

Self Cite

View full text Add to dashboard Cite

DDoS attacks are one of the biggest threats to the modern Internet as their magnitude is constantly increasing. They are highly effective because of the amplification and reflection potential of different Internet protocols. In this paper, we show how a single DNS query triggers a response packet flood to the query source, possibly because of middleboxes located in networks with routing loops. We send DNS A requests to 3 billion routable IPv4 hosts and find 15,909 query destinations from 1,742 autonomous systems that trigger up to 46.7 million repeating responses. We perform traceroute measurements towards destination hosts that resulted in the highest amplification, locate 115 routing loops on the way, and notify corresponding network operators. Finally, we analyze two years of historical scan data and find that such "mega amplifiers" are prevalent. In the worst case, a single DNS A request triggered 655 million responses, all returned to a single host.

show abstract

“…In IPv6, however, the exhaustive scan of the routable space is not feasible. Instead, we scan more than 445 million hosts from the IPv6 Hitlist Service [17].…”

Section: Internet-wide Scansmentioning

confidence: 99%

Routing Loops as Mega Amplifiers for DNS-Based DDoS Attacks

Nosyk

Korczyński

Duda

2022

Passive and Active Measurement

Self Cite

View full text Add to dashboard Cite

show abstract

“…Limitations of our experimental setup. We selected the above-mentioned services for two reasons: (1) they provide a range of common host activities that expose their IP addresses to potential scanners and (2) based on their use in IPv6 target generation and address extraction in prior work [15,37,40]. These services allow us to "leak" our address space to scanners and achieve two goals.…”

Section: Attracting Scanner Attentionmentioning

confidence: 99%

Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild

Bin¹,

Singh²,

Pearce³

et al. 2022

Preprint

View full text Add to dashboard Cite

In this work we identify scanning strategies of IPv6 scanners on the Internet. We offer a unique perspective on the behavior of IPv6 scanners by conducting controlled experiments leveraging a large and unused /56 IPv6 subnet. We selectively make parts of the subnet visible to scanners by hosting applications that make direct or indirect contact with IPv6capable servers on the Internet. By careful experiment design, we mitigate the effects of hidden variables on scans sent to our /56 subnet and establish causal relationships between IPv6 host activity types and the scanner attention they evoke. We show that IPv6 host activities e.g., Web browsing, membership in the NTP pool and Tor network, cause scanners to send a magnitude higher number of unsolicited IP scans and reverse DNS queries to our subnet than before. DNS scanners focus their scans in narrow regions of the address space where our applications are hosted whereas IP scanners broadly scan the entire subnet. Even after the host activity from our subnet subsides, we observe persistent residual scanning to portions of the address space that previously hosted applications.

show abstract

“…Port scan We use ZMap [16,46] and ZMapv6 [47] to find responsive addresses on port 0. In IPv4 we conduct Internet-wide measurements, in IPv6 we leverage an IPv6 hitlist [19,20,21]. Traceroute We use Yarrp [7,45] to traceroute addresses in IPv4 and IPv6 prefixes in order to analyze port 0 traffic filtering in the Internet.…”

Section: Datasets Overviewmentioning

confidence: 99%

“…We run four types of port scan measurements, for each possible combination of IPv4/IPv6 and TCP/UDP. The IPv4 measurements are run on the complete address space minus a blocklist, the IPv6 measurements use an IPv6 hitlist [20].…”

Section: Responsive Addressesmentioning

confidence: 99%

Zeroing in on Port 0 Traffic in the Wild

Maghsoudlou,

Gasser,

Feldmann

2021

Preprint

Self Cite

View full text Add to dashboard Cite

Internet services leverage transport protocol port numbers to specify the source and destination application layer protocols. While using port 0 is not allowed in most transport protocols, we see a non-negligible share of traffic using port 0 in the Internet. In this study, we dissect port 0 traffic to infer its possible origins and causes using five complementing flow-level and packet-level datasets. We observe 73 GB of port 0 traffic in one week of IXP traffic, most of which we identify as an artifact of packet fragmentation. In our packet-level datasets, most traffic is originated from a small number of hosts and while most of the packets have no payload, a major fraction of packets containing payload belong to the BitTorrent protocol. Moreover, we find unique traffic patterns commonly seen in scanning. In addition to analyzing passive traces, we also conduct an active measurement campaign to study how different networks react to port 0 traffic. We find an unexpectedly high response rate for TCP port 0 probes in IPv4, with very low response rates with other protocol types. Finally, we will be running continuous port 0 measurements and providing the results to the measurement community.

show abstract

Clusters in the Expanse

Cited by 92 publications

References 38 publications

Routing Loops as Mega Amplifiers for DNS-Based DDoS Attacks

Routing Loops as Mega Amplifiers for DNS-Based DDoS Attacks

Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild

Zeroing in on Port 0 Traffic in the Wild

Contact Info

Product

Resources

About