Internet nameserver IPv4 and IPv6 address relationships

Berger, Arno; Weaver, Nicholas; Beverly, Robert; Campbell, Larry

doi:10.1145/2504730.2504745

Cited by 18 publications

(10 citation statements)

References 20 publications

(17 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Figure 5(a) depicts the number of server IP addresses seen in these snapshots over time. 5 The graph shows slow growth in the cumulative number of Google IP addresses observed between November 2012 and March 2013, then a major increase in mid-March in which we saw approximately 3,000 new serving IP addresses come online. This was followed by another large jump of 3,000 in mid-May.…”

Section: Growth Over Timementioning

confidence: 93%

“…We will have to adapt the strategy for deployments where one or both of those properties do not hold. Akamai uses a resolver's geolocation in mapping decisions [5], and so it may be possible to geolocate Akamai servers based on the locations of the open resolvers they serve, even though we cannot directly measure which clients they serve. We will verify the soundness of this approach by geolocating Google front-ends using resolver locations.…”

Section: Using Our Mappingmentioning

confidence: 99%

See 1 more Smart Citation

Mapping the expansion of Google's serving infrastructure

Calder

Fan

et al. 2013

Proceedings of the 2013 Conference on Internet Measurement Conference

151

120

View full text Add to dashboard Cite

Modern content-distribution networks both provide bulk content and act as "serving infrastructure" for web services in order to reduce user-perceived latency. Serving infrastructures such as Google's are now critical to the online economy, making it imperative to understand their size, geographic distribution, and growth strategies. To this end, we develop techniques that enumerate IP addresses of servers in these infrastructures, find their geographic location, and identify the association between clients and clusters of servers. While general techniques for server enumeration and geolocation can exhibit large error, our techniques exploit the design and mechanisms of serving infrastructure to improve accuracy. We use the EDNS-client-subnet DNS extension to measure which clients a service maps to which of its serving sites. We devise a novel technique that uses this mapping to geolocate servers by combining noisy information about client locations with speed-of-light constraints. We demonstrate that this technique substantially improves geolocation accuracy relative to existing approaches. We also cluster server IP addresses into physical sites by measuring RTTs and adapting the cluster thresholds dynamically. Google's serving infrastructure has grown dramatically in the ten months, and we use our methods to chart its growth and understand its content serving strategy. We find that the number of Google serving sites has increased more than sevenfold, and most of the growth has occurred by placing servers in large and small ISPs across the world, not by expanding Google's backbone.

show abstract

Section: Growth Over Timementioning

confidence: 93%

Section: Using Our Mappingmentioning

confidence: 99%

Mapping the expansion of Google's serving infrastructure

Calder

Fan

et al. 2013

Proceedings of the 2013 Conference on Internet Measurement Conference

151

120

View full text Add to dashboard Cite

show abstract

“…In contrast our technique is active and we study servers. Our prior work also examines IPv4/IPv6 associations, but is limited to DNS resolvers [2]; the techniques herein are more general and can be performed actively, on-demand. By operating at the transport layer we can actively probe any listening TCP service to test whether a candidate IPv4 and IPv6 address belong to the same device.…”

Section: Introductionmentioning

confidence: 99%

Server Siblings: Identifying Shared IPv4/IPv6 Infrastructure Via Active Fingerprinting

Beverly

Berger

2015

Passive and Active Measurement

Self Cite

View full text Add to dashboard Cite

Abstract. We present, validate, and apply an active measurement technique that ascertains whether candidate IPv4 and IPv6 server addresses are "siblings," i.e., assigned to the same physical machine. In contrast to prior efforts limited to passive monitoring, opportunistic measurements, or end-client populations, we propose an active methodology that generalizes to all TCP-reachable devices, including servers. Our method extends prior device fingerprinting techniques to improve their feasibility in modern environments, and uses them to support measurement-based detection of sibling interfaces. We validate our technique against a diverse set of 65 web servers with known sibling addresses and find it to be over 97% accurate with 99% precision. Finally, we apply the technique to characterize the top ∼6,400 Alexa IPv6-capable web domains, and discover that a DNS name in common does not imply that the corresponding IPv4 and IPv6 addresses are on the same machine, network, or even autonomous system. Understanding sibling and non-sibling relationships gives insight not only into IPv6 deployment and evolution, but also helps characterize the potential for correlated failures and susceptibility to certain attacks.

show abstract

“…IPv6-IPv4 Sibling Detection: The problem of classifying sibling relationships at a machine level has first been tackled by Berger et al [9]. Using customized DNS replies, they associate DNS client resolvers through opportunistic passive probing and open DNS resolvers through active probing.…”

Section: Related Workmentioning

confidence: 99%

Large-scale classification of IPv6-IPv4 siblings with variable clock skew

Scheitle

Gasser

Rouhi

et al. 2017

2017 Network Traffic Measurement and Analysis Conference (TMA)

View full text Add to dashboard Cite

Linking the growing IPv6 deployment to existing IPv4 addresses is an interesting field of research, be it for network forensics, structural analysis, or reconnaissance. In this work, we focus on classifying pairs of server IPv6 and IPv4 addresses as siblings, i.e., running on the same machine. Our methodology leverages active measurements of TCP timestamps and other network characteristics, which we measure against a diverse ground truth of 682 hosts. We define and extract a set of features, including estimation of variable (opposed to constant) remote clock skew. On these features, we train a manually crafted algorithm as well as a machine-learned decision tree. By conducting several measurement runs and training in cross-validation rounds, we aim to create models that generalize well and do not overfit our training data. We find both models to exceed 99% precision in train and test performance. We validate scalability by classifying 149k siblings in a large-scale measurement of 371k sibling candidates. We argue that this methodology, thoroughly cross-validated and likely to generalize well, can aid comparative studies of IPv6 and IPv4 behavior in the Internet. Striving for applicability and replicability, we release ready-to-use source code and raw data from our study.

show abstract

Internet nameserver IPv4 and IPv6 address relationships

Cited by 18 publications

References 20 publications

Mapping the expansion of Google's serving infrastructure

Mapping the expansion of Google's serving infrastructure

Server Siblings: Identifying Shared IPv4/IPv6 Infrastructure Via Active Fingerprinting

Large-scale classification of IPv6-IPv4 siblings with variable clock skew

Contact Info

Product

Resources

About