Yarrp'ing the Internet

Beverly, Robert

doi:10.1145/2987443.2987479

Cited by 38 publications

(4 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Internet Control Message Protocol (ICMP) [60], [12] is commonly used in troubleshooting [24], topology discovery [5], [7], [36], [74], and network management [10], [70]. Wellknown tools like ping, traceroute, and their variations are all mainly based on ICMP.…”

Section: A Icmp Rate Limitingmentioning

confidence: 99%

“…These peripheries are actually the remote "vantage points" (RVPs) that will be used in the subsequent measurements. To collect the data pairs, we implement a stateless scanner like many existing high-speed probers [16], [5], [36]. In consideration of the large address space of IPv6 networks, we cannot perform an exhaustive scan.…”

Section: "Vantage Point" Discoverymentioning

confidence: 99%

See 1 more Smart Citation

Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

Pan¹,

Yang²,

Wang³

et al. 2023

Proceedings 2023 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Active Internet measurements face challenges when some measurements require many remote vantage points. In this paper, we propose a novel technique for measuring remote IPv6 networks via side channels in ICMP rate limiting, a required function for IPv6 nodes to limit the rate at which ICMP error messages are generated. This technique, IVANTAGE, can to some extent use 1.1M remote routers distributed in 9.5k autonomous systems and 182 countries as our "vantage points". We apply IVANTAGE to two different, but both challenging measurement tasks: 1) measuring the deployment of inbound source address validation (ISAV) and 2) measuring reachability between arbitrary Internet nodes. We accomplish these two tasks from only one local vantage point without controlling the targets or relying on other services within the target networks. Our large-scale ISAV measurements cover ∼50% of all IPv6 autonomous systems and find ∼79% of them are vulnerable to spoofing, which is the most large-scale measurement study of IPv6 ISAV to date. Our method for reachability measurements achieves over 80% precision and recall in our evaluation. Finally, we perform an Internet-wide measurement of the ICMP rate limiting implementations, present a detailed discussion on ICMP rate limiting, particularly the potential security and privacy risks in the mechanism of ICMP rate limiting, and provide possible mitigation measures. We make our code available to the community.

show abstract

Section: A Icmp Rate Limitingmentioning

confidence: 99%

Section: "Vantage Point" Discoverymentioning

confidence: 99%

Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

Pan¹,

Yang²,

Wang³

et al. 2023

Proceedings 2023 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…The ARK probing platform, with its extensive deployment of probing sources in over 40 countries, has significantly expanded the coverage of network topology discovery, enhanced data quality and magnitude, and provided valuable resources for researching global Internet structures. To further accelerate network-wide probing, Beverly [25] adopted and improved the stateless asynchronous packettransmission mechanism introduced by Durumeric et al [26]. This approach established independent and parallel probing and response threads, thereby substantially increasing the scanning efficiency.…”

Section: Introductionmentioning

confidence: 99%

Stop-probability-based network topology discovery method

Yuguang,

Zhiyong,

Wei

et al. 2024

IEICE Trans. Commun.

View full text Add to dashboard Cite

Using a limited number of probes has always been a focus in interface-level network topology probing to discover complete network topologies. Stop-set-based network topology probing methods significantly reduce the number of probes sent but suffer from the side effect of incomplete topology information discovery. This study proposes an optimized probing method based on stop probabilities (SPs) that builds on existing stop-set-based network topology discovery methods to address the issue of incomplete topology information owing to multipath routing. The statistics of repeat nodes (RNs) and multipath routing on the Internet are analyzed and combined with the principles of stop-set-based probing methods, highlighting that stopping probing at the first RN compromises the completeness of topology discovery. To address this issue, SPs are introduced to adjust the stopping strategy upon encountering RNs during probing. A method is designed for generating SPs that achieves high completeness and low cost based on the distribution of the number of RNs. Simulation experiments demonstrate that the proposed stop-probability-based probing method almost completely discovers network nodes and links across different regions and times over a two-year period, while significantly reducing probing redundancy. In addition, the proposed approach balances and optimizes the trade-off between complete topology discovery and reduced probing costs compared with existing topology probing methods. Building on this, the factors influencing the probing cost of the proposed method and methods to further reduce the number of probes while ensuring completeness are analyzed. The proposed method yields universally applicable SPs in the current Internet environment.

show abstract

“…Internet-wide scanning allows researchers and network operators to understand how the Internet works in practice, and has been used to study network topology [16,38], operator decisions [20,28] and security vulnerabilities [15,17]. Internet-wide scanning works by initiating network connections with services on a set of given ports.…”

Section: Introductionmentioning

confidence: 99%

Predicting IPv4 services across all ports

Izhikevich

Teixeira

Durumeric

2022

Proceedings of the ACM SIGCOMM 2022 Conference

View full text Add to dashboard Cite

Internet-wide scanning is commonly used to understand the topology and security of the Internet. However, IPv4 Internet scans have been limited to scanning only a subset of services-exhaustively scanning all IPv4 services is too costly and no existing bandwidthsaving frameworks are designed to scan IPv4 addresses across all ports. In this work we introduce GPS, a system that efficiently discovers Internet services across all ports. GPS runs a predictive framework that learns from extremely small sample sizes and is highly parallelizable, allowing it to quickly find patterns between services across all 65K ports and a myriad of features. GPS computes service predictions in 13 minutes (four orders of magnitude faster than prior work) and finds 92.5% of services across all ports with 131× less bandwidth, and 204× more precision, compared to exhaustive scanning. GPS is the first work to show that, given at least two responsive IP addresses on a port to train from, predicting the majority of services across all ports is possible and practical.

show abstract

Yarrp'ing the Internet

Cited by 38 publications

References 23 publications

Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

Stop-probability-based network topology discovery method

Predicting IPv4 services across all ports

Contact Info

Product

Resources

About