Internet-Scale IPv4 Alias Resolution With MIDAR

Keys, Ken; Hyun, Young; Luckie, Matthew; Claffy, Kimberly C.

doi:10.1109/tnet.2012.2198887

Cited by 94 publications

(96 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…6(c). As an early study on fingerprinting [10] hinted that initial TTL values correlate with the equipment brand (in particular, an initial TTL of 255 8 likely originates from Cisco equipment), this suggests that grouping addresses with similar fingerprints amounts to grouping IP interfaces which likely belong to devices from a same vendor, which further demonstrates the soundness of our approach.…”

Section: B Space Search Reductionmentioning

confidence: 63%

“…We validate our approach by analyzing a groundtruth network with TreeNET, that implements our methodology, and the state-of-the-art tools MIDAR [8] and kapar [9]. Our validation shows that the upgraded TreeNET is able to achieve accuracy close to that of MIDAR while using less probes and discovering subnets.…”

Section: Introductionmentioning

confidence: 87%

“…The counter used by a router to choose a value for this field is often the same for all interfaces and it is expected to be simply incremented at each received packet. As a consequence, this field has been exploited for alias resolution by tools like Ally [13], RadarGun [19], and MIDAR [8]. In particular, RadarGun and MIDAR study the speed at which the counter increments and alias IP addresses when their respective velocity of incrementing their IP identifier is close (RadarGun) or show the same monotonicity (MIDAR).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Towards a renewed alias resolution with space search reduction and IP fingerprinting

Grailet

Donnet

2017

2017 Network Traffic Measurement and Analysis Conference (TMA)

View full text Add to dashboard Cite

Abstract-Since the early 2000's, the Internet Topology has been frequently described and modeled from the perspective of routers. To this end, alias resolution mechanisms have been developed in order to aggregate all IP interfaces of a router, collected with traceroute, into a single identifier. So far, many active measurement techniques have been considered, often taking advantage of specific features from network protocols. However, a lot of these methods have seen their efficiency decrease over time due to security reinforcements across the Internet.In this paper, we introduce a generic methodology to conduct efficient and scalable alias resolution. It combines the space search reduction of TreeNET (a tool for efficiently discovering subnets) with a fingerprinting process used to assess the feasibility of several state-of-the-art alias resolution methods, using a small, fixed amount of probes. We validate our method along MIDAR on an academic groundtruth and demonstrate that our methodology can achieve similar accuracy while using less probes and discovering subnets in the process. We further evaluate our method with measurements made on PlanetLab towards several distinct ASes of varying sizes and roles in the Internet. The collected data shows that some properties of our fingerprints correlate with each other, hinting some observed profiles could be linked with equipment vendors. Both TreeNET (which implements our methodology) and our dataset are freely available.

show abstract

Section: B Space Search Reductionmentioning

confidence: 63%

Section: Introductionmentioning

confidence: 87%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Towards a renewed alias resolution with space search reduction and IP fingerprinting

Grailet

Donnet

2017

2017 Network Traffic Measurement and Analysis Conference (TMA)

View full text Add to dashboard Cite

show abstract

“…While similar IP-ID behavior is found in IPv4 routers, there are three important differences. First, the IPID counter behavior in IPv4 is much more erratic because routers increment the ID counter every time they create a packet, causing the counter's velocity to be large for routers with chatty routing protocols or SNMP reporting [1,13]. Second, the counter itself only has a range of 65536 values, requiring more frequent probing than in IPv6 to prevent a counter wrap from being interpreted as a reboot.…”

Section: Limitationsmentioning

confidence: 99%

Measuring and Characterizing IPv6 Router Availability

Beverly

Luckie

Mosley

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We consider the problem of inferring IPv6 router uninterrupted system availability, or uptime, from a remote vantage point without privileged access. Uptime inference is important to broader efforts to measure and characterize the availability of critical infrastructure, provides insight into network operations, and has subtle security implications. Our approach utilizes active probes to periodically elicit IPv6 fragment identifiers from IPv6 router interfaces, and analyzes the resulting identifier time series for reboots. We demonstrate the approach's potential by characterizing 21,539 distinct IPv6 router interfaces over a five-month period. We find evidence of clustered reboot events, popular maintenance windows, and correlation with globally visible control plane data. Our results, validated by five ASes, provide initial insight into the current state of IPv6 router availability.

show abstract

“…MIDAR (Monotonic ID-Based Alias Resolution) [103] is designed for performing alias resolution, using the IP identifier technique, for a very large-scale of targets (on the order of several millions). The comparison of IP identifiers is, here, based on monotonicity instead of proximity.…”

Section: Active Methodsmentioning

confidence: 99%

Internet Topology Discovery

Donnet

2013

Data Traffic Monitoring and Analysis

View full text Add to dashboard Cite

Abstract. Since the nineties, the Internet has seen an impressive growth, in terms of users, intermediate systems (such as routers), autonomous systems, or applications. In parallel to this growth, the research community has been looking for obtaining and modeling the Internet topology, i.e., how the various elements of the network interconnect between themselves. An impressive amount of work has been done regarding how to collect data and how to analyse and model it. This chapter reviews main approaches for gathering Internet topology data. We first focus on hop limited probing, i.e., traceroute-like probing. We review large-scale tracerouting projects and discuss traceroute limitations and how they are mitigated by new techniques or extensions. Hop limited probing can reveal an IP interface vision of the Internet. We next focus on techniques for aggregating several IP interfaces of a given router into a single identifier. This leads to a router level vision of the topology. The aggregation can be done through a process called alias resolution. We also review a technique based on IGMP probing that silently collect all multicast interfaces of a router into a single probe. We next refine the router level topology by adding subnet information. We finish this chapter by discussing the AS level topology, in particular the relationships between ASes and the induced hierarchy.

show abstract

Internet-Scale IPv4 Alias Resolution With MIDAR

Cited by 94 publications

References 16 publications

Towards a renewed alias resolution with space search reduction and IP fingerprinting

Towards a renewed alias resolution with space search reduction and IP fingerprinting

Measuring and Characterizing IPv6 Router Availability

Internet Topology Discovery

Contact Info

Product

Resources

About