Ipv6 address finding methods tested with shared evaluation system
6SEVEN: System for EValuating IPv6 ENumeration algorithms
Networking and Internet Architecture
Summary
Finding active internet addresses in IPv6 is hard because the address space is huge and mostly empty. Many techniques exist to guess which addresses might be active, but comparing these methods has been difficult due to inconsistent testing. The authors created 6SEVEN, a system that lets multiple guessing methods be tested fairly using the same data and criteria. They showed that differences in results often come from factors other than the main guessing method, like the choice of initial data and how results are counted. This system aims to help people improve how internet addresses are discovered in the future.
What this means in practice
- •For network operators: Use a standardized system to test and compare different IPv6 address discovery methods to improve network scanning accuracy.
- •For security teams: Evaluate IPv6 address scanning algorithms within a consistent framework to better identify potential vulnerable or active hosts.
Authors
Chase Kanipe, Erik Rye, Dave Levin, Robert Beverly
Abstract
The vast, sparsely populated, and often ephemeral IPv6 address space makes discovering active addresses challenging. In response, the community has developed over thirty different IPv6 Target Generation Algorithms (TGAs). TGAs learn addressing structure from seed (training) datasets, build a representative model, and generate candidate addresses. Unfortunately, the existing literature employs a wide variety of input seeds, data cleansing, and metrics of success that prevent ready comparison. Toward making TGA evaluation consistent, we present 6SEVEN, an extensible framework that hosts TGAs as plugins and links them to shared data cleaning, probing, dealiasing, and result tabulation components. We port as 6SEVEN plugins eight popular TGAs and demonstrate a controlled case study. Our results show that the performance of these TGAs varies substantially due to factors independent of the main algorithm---especially the seed set composition, dealiasing, and tabulation procedures. We observe tradeoffs between desirable features of TGA performance, including yield and exploration. We envision 6SEVEN as an enabling community resource to advance the science of current and future TGAs, and, by extension, IPv6 measurement.