Inferring regional access network topologies

Zhang, Zesen; Marder, Alexander; Mok, Ricky K. P.; Huffaker, Bradley; Luckie, Matthew; claffy, kc; Schulman, Aaron

doi:10.1145/3487552.3487812

Cited by 10 publications

(9 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While existing literature has shown that meaningful information can be extracted from hostnames primarily without considering continual changes to records, we reveal that observing automated changes to rDNS can provide insights into client presence and network dynamics. We keep the invasiveness of our case studies in check and tailored our approach, but given recent findings that hostnames can encode building locations [25], it appears feasible that for some networks, rDNS data can be used to geotemporally track users at the building level.…”

Section: Discussionmentioning

confidence: 99%

“…Future efforts, provided that they are ethically feasible, could also focus on the potential for fine-grained geotemporal user tracking. We used a posteriori knowledge on IP subnet allocations in one case study, but related work has established that access network topology can be inferred from hostnames [25]. We imagine that combining such information with client presence inferences can have far-reaching privacy implications.…”

Section: Discussionmentioning

confidence: 99%

“…In their paper, they study means to infer the connection types of hosts in access networks. Zhang et al [25], in turn, infer and geolocate topology in regional access networks, with the aim of studying architectural choices made by ISPs.…”

Section: Related Workmentioning

confidence: 99%

“…Since the hostnames contain given names this may even be tied to specific individuals. If one knows or were to infer how addresses are assigned to, e.g., specific buildings [25] on campus, one could track a Brian around campus as he goes from lecture to lecture, from anywhere on the Internet.…”

Section: Life Of Brian(s)mentioning

confidence: 99%

See 3 more Smart Citations

Saving Brian's Privacy: the Perils of Privacy Exposure through Reverse DNS

Toorn¹,

Sommese²,

Sperotto³

et al. 2022

Preprint

View full text Add to dashboard Cite

Given the importance of privacy, many Internet protocols are nowadays designed with privacy in mind (e.g., using TLS for confidentiality). Foreseeing all privacy issues at the time of protocol design, however, is challenging and may become near impossible when interaction out of protocol bounds occurs.One demonstrably not well understood interaction occurs when DHCP exchanges are accompanied by automated changes to the global DNS, for example to dynamically add hostnames for allocated IP addresses. As we will substantiate in this paper, this is a privacy risk: the presence of specific clients and network dynamics may be learned from virtually anywhere on the Internet, even if other mechanisms to limit tracking by outsiders (e.g., blocking pings) are in place.We present a first of its kind study into this risk. We identify networks that expose client identifiers in reverse DNS records and study the relation between the presence of clients and said records. Our results show a strong link: in 9 out of 10 cases, records linger for at most an hour, for a selection of academic, enterprise and ISP networks alike. We also demonstrate how client patterns and network dynamics can be learned, by tracking devices owned by persons named Brian over time, revealing shifts in work patterns caused by COVID-19 related work-from-home measures, and by determining a good time to stage a heist.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Discussionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Life Of Brian(s)mentioning

confidence: 99%

See 2 more Smart Citations

Saving Brian's Privacy: the Perils of Privacy Exposure through Reverse DNS

Toorn¹,

Sommese²,

Sperotto³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…With respect to ISP mapping, few other tools than traceroute and Rocketfuel exist. There is notably [51], that focuses on the exploration of an essential component of an ISP's infrastructure: its regional access network. By combining several Internet cartography methods (such as public WiFi hotspots and public transit of mobile devices), they are able to get some insight on this specific ISP portion, although it is often remarkably opaque and difficult to measure.…”

Section: Related Workmentioning

confidence: 99%

ISP Probing Reduction with Anaximander

Marechal

Mérindol

Donnet

2022

Passive and Active Measurement

View full text Add to dashboard Cite

Since the early 2000's, Internet topology discovery has been an active research topic, providing data for various studies such as Internet modeling, network management, or to assist and support network protocol design. Within this research area, ISP mapping at the router level has attracted little interest despite its utility to perform intra-domain routing evaluation. Since Rocketfuel (and, to a smaller extent, mrinfo), no new tool or method has emerged for systematically mapping intra-domain topologies. In this paper, we introduce Anaximander, a new efficient approach for probing and discovering a targeted ISP in particular. Considering a given set of vantage points, we implement and combine several predictive strategies to mitigate the number of probes to be sent without sacrificing the ISP coverage. To assess the ability of our method to efficiently retrieve an ISP map, we rely on a large dataset of ISPs having distinct nature and demonstrate how Anaximander can be tuned with a simple parameter to control the trade-off between coverage and probing budget.

show abstract