A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP Signals

Publikation: Beitrag in FachzeitschriftKonferenzartikelBeigetragenBegutachtung

Beitragende

Abstract

Scanners are daily visitors of public IPv4 hosts. Scanning IPv6 nodes successfully is still a challenge, which an increasing crowd of actors tries to master. In this paper, we analyze IPv6 scanning under various network conditions to disclose the impact on scanning. We deploy four IPv6 network telescopes, including a reactive /48 telescope and a proactive /32 telescope that is periodically reconfigured by changing BGP announcements. We provide a longitudinal study of eleven months and classify the observed scanners w.r.t. their temporal behavior, their target and network selection strategies, as well as their individual tools, fingerprints, and correlations across categories. We find that silent subnets of larger covering prefixes remain mainly invisible, whereas BGP prefix announcements quickly attract attention by scanners. Based on our findings, we derive operational guidance on how to deploy network telescopes to increase visibility for IPv6 scanners and understand corresponding biases.

Details

OriginalspracheEnglisch
Aufsatznummer15
Seiten (von - bis)1-23
Seitenumfang23
FachzeitschriftProceedings of the ACM on Networking
Jahrgang3
AusgabenummerCoNEXT3
PublikationsstatusVeröffentlicht - 4 Sept. 2025
Peer-Review-StatusJa

Konferenz

TitelACM 21th International Conference on emerging Networking EXperiments and Technologies
KurztitelCoNEXT 2025
Veranstaltungsnummer21
Dauer1 - 4 Dezember 2025
Webseite
BekanntheitsgradInternationale Veranstaltung
OrtThe Hong Kong University of Science and Technology
StadtHong Kong
LandHongkong

Externe IDs

ORCID /0000-0002-3825-2807/work/191042023
Mendeley f5477180-9eed-302d-993e-a5dbecb3af99

Schlagworte

Fächergruppen, Lehr- und Forschungsbereiche, Fachgebiete nach Destatis

Ziele für nachhaltige Entwicklung

Bibliotheksschlagworte