Detecting IPv4 Subnets in the Wild
Taha Albakour (Max Planck Institut für Informatik)
Fariba Osali (Max Planck Institut für Informatik, Saarland University)
Max Franke (Technical University of Berlin)
Georgios Smaragdakis (TU Delft - Electrical Engineering, Mathematics and Computer Science)
More Info
expand_more
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
In this paper, we present methodologies based on two Internet Control Message Protocol (ICMP) message types to measure subnet deployments on the Internet. First, we exploit a peculiar behavior in certain router implementations, together with variations in the interpretation of protocol specifications, to infer prefix boundaries and thus prefix lengths through remotely probing the Internet with specially crafted ICMP Echo requests. Second, we evaluate the extent to which hosts continue to respond to the deprecated ICMP Address Mask request. We assess the applicability of these methods across devices from different network vendors and discuss protocol quirks that arise from lenient interpretations of the specifications. By combining both methods, we evaluate the consistency of our approach and present a dataset comprising 3.8M subnets. This dataset covers 15% of BGP announced prefixes across more than 20k autonomous systems. Using this dataset, we examine the uniformity of host responsiveness within autonomous systems and across subnet sizes, finding that smaller subnets tend to exhibit greater uniformity. Ultimately, our work demonstrates the feasibility of subnet inference, at a reasonable Internet scale.
help_outline