Alias Resolution Based on ICMP Rate Limiting

Abstract

Alias resolution techniques (e.g., Midar) associate, mostly through active measurement, a set of IP addresses as belonging to a common router. These techniques rely on distinct router features that can serve as a signature. Their applicability is affected by router support of the features and the robustness of the signature. This paper presents a new alias resolution tool called Limited Ltd. that exploits ICMP rate limiting, a feature that is increasingly supported by modern routers that has not previously been used for alias resolution. It sends ICMP probes toward target interfaces in order to trigger rate limiting, extracting features from the probe reply loss traces. It uses a machine learning classifier to designate pairs of interfaces as aliases. We describe the details of the algorithm used by Limited Ltd. and illustrate its feasibility and accuracy. Limited Ltd. not only is the first tool that can perform alias resolution on IPv6 routers that do not generate monotonically increasing fragmentation IDs (e.g., Juniper routers) but it also complements the state-of-the-art techniques for IPv4 alias resolution. All of our code and the collected dataset are publicly available.

Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

“…Therefore, in the IPv6 version of ICMP (ICMPv6) [12], IPv6 nodes are required to limit the rate at which ICMP error messages are originated. Related work [74], [7] and our measurement results also demonstrate that ICMP rate limiting is more common in IPv6 networks than in IPv4.…”

“…Internet Control Message Protocol (ICMP) [60], [12] is commonly used in troubleshooting [24], topology discovery [5], [7], [36], [74], and network management [10], [70]. Wellknown tools like ping, traceroute, and their variations are all mainly based on ICMP.…”

FBAR: An effective method for resolving large‐scale IPv6 aliases

“…10 Both methods have high discrimination accuracies, but statistics show that only 32% of the routers in the actual deployment use the shared counter, which seriously affects the applicability of these methods. In 2020, Vermeulen et al 12 proposed an alias resolution algorithm based on ICMP rate limit called Limited Ltd. It sends ICMP probe packets to target router interfaces to trigger ICMP rate limit and extracts features from the probe response loss trace.…”

“…Some researchers have proposed some IPv6 alias resolution algorithms, especially Speedtrap algorithm based on IPID 11 and Limited Ltd algorithm based on Internet Control Message Protocol (ICMP) rate. 12 Speedtrap uses the fragmentation characteristics of routers to resolve IPv6 aliases. However, statistics show that only 32% of the deployed routers use shared counters, which seriously affects the applicability of this method.…”

“…Some researchers have proposed some IPv6 alias resolution algorithms, especially Speedtrap algorithm based on IPID 11 and Limited Ltd algorithm based on Internet Control Message Protocol (ICMP) rate 12 . Speedtrap uses the fragmentation characteristics of routers to resolve IPv6 aliases.…”