Sibling Prefixes: Identifying Similarities in IPv4 and IPv6 Prefixes

TL;DR

This paper introduces the concept of sibling prefixes to identify related IPv4 and IPv6 address prefixes, using DNS data to improve understanding of dual-stack network configurations and their stability.

Contribution

It extends the sibling concept from individual IP addresses to prefixes, presents a large-scale identification technique, and introduces SP-Tuner for CIDR size optimization.

Findings

Identified 76,000 IPv4-IPv6 sibling prefixes.

Sibling prefixes are relatively stable over time.

Over 50% of sibling prefixes share the same organization name.

Abstract

Since the standardization of IPv6 in 1998, both versions of the Internet Protocol have coexisted in the Internet. Clients usually run algorithms such as Happy Eyeballs, to decide whether to connect to an IPv4 or IPv6 endpoint for dual-stack domains. To identify whether two addresses belong to the same device or service, researchers have proposed different forms of alias resolution techniques. Similarly, one can also form siblings of IPv4 and IPv6 addresses belonging to the same device. Traditionally, all of these approaches have focused on individual IP addresses. In this work, we propose the concept of "sibling prefixes", where we extend the definition of an IPv4-IPv6 sibling to two IP prefixe-one IPv4 prefix and its sibling IPv6 prefix. We present a technique based on large-scale DNS resolution data to identify 76k IPv4-IPv6 sibling prefixes. We find sibling prefixes to be relatively stable over time. We present SP-Tuner algorithm to tune the CIDR size of sibling prefixes and improve the perfect match siblings from 52% to 82%. For more than half of sibling prefixes, the organization names for their IPv4 and IPv6 origin ASes are identical, and 60% of all sibling prefixes have at least one of the prefixes with a valid ROV status in RPKI. Furthermore, we identify sibling prefixes in 24 hypergiant and CDN networks. Finally, we plan to regularly publish a list of sibling prefixes to be used by network operators and fellow researchers in dual-stack studies.