Scanning the IPv6 Internet Using Subnet-Router Anycast Probing

TL;DR

This paper demonstrates that Subnet-Router Anycast probing is an effective and less rate-limited method for discovering IPv6 addresses, revealing significantly more routers than traditional approaches and highlighting potential network stability issues.

Contribution

It introduces and evaluates active SRA probing as a novel technique for IPv6 address space exploration, showing its advantages over existing methods.

Findings

SRA probing finds 10% more router addresses than random probing.

SRA is less affected by ICMP rate limiting.

SRA discovers 80% more addresses than direct router targeting.

Abstract

Identifying active IPv6 addresses is challenging. Various methods emerged to master the measurement challenge in this huge address space, including hitlists, new probing techniques, and AI-generated target lists. In this paper, we apply active Subnet-Router anycast (SRA) probing, a commonly unused method to explore the IPv6 address space. We compare our results with lists of active IPv6 nodes obtained from prior methods and with random probing. Our findings indicate that probing an SRA address reveals on average 10% more router IP addresses than random probing and is far less affected by ICMP rate limiting. Compared to targeting router addresses directly, SRA probing discovers 80% more addresses. We conclude that SRA probing is an important addition to the IPv6 measurement toolbox and may improve the stability of results significantly. We also find evidence that some active scans can cause harmful conditions in current IPv6 deployments, which we started to fix in collaboration with network operators.