Preprint
Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild
ArXiv.org
10/05/2022
Abstract
In this work we identify scanning strategies of IPv6 scanners on the
Internet. We offer a unique perspective on the behavior of IPv6 scanners by
conducting controlled experiments leveraging a large and unused /56 IPv6
subnet. We selectively make parts of the subnet visible to scanners by hosting
applications that make direct or indirect contact with IPv6- capable servers on
the Internet. By careful experiment design, we mitigate the effects of hidden
variables on scans sent to our /56 subnet and establish causal relationships
between IPv6 host activity types and the scanner attention they evoke. We show
that IPv6 host activities e.g., Web browsing, membership in the NTP pool and
Tor network, cause scanners to send a magnitude higher number of unsolicited IP
scans and reverse DNS queries to our subnet than before. DNS scanners focus
their scans in narrow regions of the address space where our applications are
hosted whereas IP scanners broadly scan the entire subnet. Even after the host
activity from our subnet subsides, we observe persistent residual scanning to
portions of the address space that previously hosted applications
Details
- Title: Subtitle
- Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild
- Creators
- Hammas Bin TanveerRachee SinghPaul PearceRishab Nithyanand
- Resource Type
- Preprint
- Publication Details
- ArXiv.org
- ISSN
- 2331-8422
- Language
- English
- Date posted
- 10/05/2022
- Academic Unit
- Computer Science; Law Faculty; Public Policy Center (Archive); Center for Social Science Innovation
- Record Identifier
- 9984304059702771
Metrics
4 Record Views