Scanning the IPv6 Internet: Towards a Comprehensive Hitlist

TL;DR

This paper presents a hybrid method combining passive data, rDNS, and traceroute to create a comprehensive IPv6 address hitlist, enabling better understanding and scanning of the IPv6 Internet.

Contribution

It introduces a novel hybrid approach for generating a large IPv6 address hitlist, covering 72% of prefixes and 84% of Autonomous Systems, with practical recommendations for efficient scanning.

Findings

Found 150 million unique IPv6 addresses in four weeks.

Achieved 72% coverage of announced prefixes and 84% of Autonomous Systems.

Provided strategies to optimize source efficiency for different scan types.

Abstract

Active network measurements constitute an impor- tant part in gaining a better understanding of the Internet. Although IPv4-wide scans are now easily possible, random active probing is infeasible in the IPv6 Internet. Therefore, we propose a hybrid approach to generate a hitlist of IPv6 addresses for scanning: First, we extract IPv6 addresses from passive flow data. Second, we leverage publicly available resources such as rDNS data to gather further IPv6 addresses. Third, we conduct traceroute measurements from several vantage points to obtain additional addresses. We perform multiple active measurements on gathered IPv6 addresses and evaluate response rates over time. We extensively compare all IPv6 address sources. In total we found 150M unique IPv6 addresses over the course of four weeks. Our hitlist covers 72% of announced prefixes and 84% of Autonomous Systems. Finally, we give concrete recommendations to maximize source efficiency for different scan types.