Abstract
Uncovering the Internet’s router graph is vital to accurate measurement and analysis. In this paper, we present a new technique for resolving router IP aliases that complements existing techniques. Our approach, Alias Pruning by Path Length Estimation (apple), avoids relying on router manufacturer and operating system specific implementations of IP. Instead, it filters potential router aliases seen in traceroute by comparing the reply path length from each address to a distributed set of vantage points.
We evaluated our approach on Internet-wide collections of IPv4 and IPv6 traceroutes. We compared apple’s router alias inferences against router configurations from two R&E networks, finding no false positives. Moreover, apple’s coverage of the potential alias pairs in the ground truth networks rivals the current state-of-the-art in IPv4, and far exceeds existing techniques in IPv6. We also show that apple complements existing alias resolution techniques, increasing the total number of inferred alias pairs by 109.6% in IPv4, and by 1071.5% in IPv6.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsReferences
Internet topology data kit - April 2019. http://www.caida.org/data/internet-topology-data-kit/. Accessed Apr 2019
Internet topology data kit - January 2019. http://www.caida.org/data/internet-topology-data-kit/. Accessed Jan 2019
Ager, B., Chatzis, N., Feldmann, A., Sarrar, N., Uhlig, S., Willinger, W.: Anatomy of a large European IXP. In: ACM SIGCOMM CCR (2012)
Amini, L.D., Shaikh, A., Schulzrinne, H.G.: Issues with inferring Internet topological attributes. In: Internet Performance and Control of Network Systems III (2002)
Augustin, B., Krishnamurthy, B., Willinger, W.: IXPs: mapped? In: IMC (2009)
Baker, F.: RFC 1812: requirements for IP version 4 routers. Technical report, Internet Engineering Task Force (1995)
Bender, A., Sherwood, R., Spring, N.: Fixing ally’s growing pains with velocity modeling. In: IMC (2008)
Govindan, R., Tangmunarunkit, H.: Heuristics for Internet map discovery. In: Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies, Proceedings, INFOCOM 2000. IEEE (2000)
Grailet, J.F., Donnet, B.: Towards a renewed alias resolution with space search reduction and IP fingerprinting. In: Network Traffic Measurement and Analysis Conference (TMA) (2017)
Gunes, M.H., Sarac, K.: Resolving IP aliases in building traceroute-based Internet maps. IEEE/ACM Trans. Netw. 17, 1738–1751 (2009)
Hyun, Y., Broido, A., Claffy, K.: On third-party addresses in traceroute paths. In: PAM (2003)
Jacobson, V.: Traceroute. ftp://ftp.ee.lbl.gov/traceroute.tar.gz
Keys, K.: Internet-scale IP alias resolution techniques. ACM SIGCOMM Comput. Commun. Rev. (CCR) 40, 50–55 (2010)
Keys, K.: iffinder. https://www.caida.org/tools/measurement/iffinder/
Keys, K., Hyun, Y., Luckie, M., Claffy, K.: Internet-scale IPv4 alias resolution with MIDAR. IEEE/ACM Trans. Netw. 21, 383–399 (2013)
Luckie, M., Beverly, R., Brinkmeyer, W., et al.: Speedtrap: internet-scale IPv6 alias resolution. In: IMC (2013)
Luckie, M., Dhamdhere, A., Huffaker, B., Clark, D., Claffy, K.: bdrmap: inference of borders between IP networks. In: IMC (2016)
Luckie, M., Huffaker, B., et al.: Learning regexes to extract router names from hostnames. In: IMC (2019)
Marder, A., Luckie, M., Dhamdhere, A., Huffaker, B., Claffy, K., Smith, J.M.: Pushing the boundaries with bdrmapIT: mapping router ownership at internet scale. In: IMC (2018)
Marder, A., Luckie, M., Huffaker, B., Claffy, K.: vrfinder: finding forwarding addresses in traceroute. In: POMACS (2020)
Marder, A., Smith, J.M.: MAP-IT: multipass accurate passive inferences from traceroute. In: IMC (2016)
Padmanabhan, R., Li, Z., Levin, D., Spring, N.: UAv6: alias resolution in IPv6 using unused addresses. In: PAM (2015)
Sayrafiezadeh, M.: The birthday problem revisited. Math. Mag. 67(3), 220–223 (1994)
Spring, N., Dontcheva, M., Rodrig, M., Wetherall, D.: How to resolve IP aliases. Technical report, UW-CSE-TR 04–05-04, University of Washington (2004)
Spring, N., Mahajan, R., Wetherall, D.: Measuring ISP topologies with Rocketfuel. ACM SIGCOMM CCR 32, 133–145 (2002)
Touch, J.: RFC 6864: updated specification of the ipv4 id field. Technical report, Internet Engineering Task Force, February 2013
Vanaubel, Y., Luttringer, J., Mérindol, P., Pansiot, J., Donnet, B.: TNT, watch me explode: a light in the dark for revealing MPLS tunnels. In: Network Traffic Measurement and Analysis Conference, June 2019
Vanaubel, Y., Mérindol, P., Pansiot, J.J., Donnet, B.: Through the wormhole: tracking invisible MPLS tunnels. In: IMC (2017)
Vanaubel, Y., Pansiot, J.J., Mérindol, P., Donnet, B.: Network fingerprinting: TTL-based router signatures. In: IMC (2013)
Viger, F., et al.: Detection, understanding, and prevention of traceroute measurement artifacts. Comput. Netw. 52(5), 998–1018 (2008)
Acknowledgments
We thank kc claffy, Matthew Luckie, and Young Hyun for their invaluable feedback. This work was supported by NSF grants OAC-1724853 and OIA-1937165.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
A Generalizing the Birthday Problem to Alias Resolution
A Generalizing the Birthday Problem to Alias Resolution
The birthday problem computes the probability that any combination of n people share the same birthday. A common approximate general solution [23] takes the form,
where d is the number of days in the year. Of note, the \(\frac{n(n-2)}{2}\) term corresponds to the number of possible two-person combinations. Using a to represent the number of combinations, the equation takes the form,
Applying this equation to our problem, we first replace the number of combinations with the number of potential alias pairs. Second, we must determine the potential reply space for each address. When an address replies to a VP, the VP sees a reply TTL from the space of possible reply TTLs, r. If we assume that a reply TTL to one VP is independent of all the others, then the potential reply space for an address is \(r^v\). Practically, we consider \(r^v\) an upper bound on the possible combinations, since we expect that the network topology and control plane create dependent probabilities. Plugging \(r^v\) in for d we get the approximate probability that a pair of addresses will have the same combination of replies to all v VPs,
To limit collisions, while maximizing the number of true alias pairs, we use the smallest value of v such that \(p(a,r,v) < 1/a\).
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Marder, A. (2020). APPLE: Alias Pruning by Path Length Estimation. In: Sperotto, A., Dainotti, A., Stiller, B. (eds) Passive and Active Measurement. PAM 2020. Lecture Notes in Computer Science(), vol 12048. Springer, Cham. https://doi.org/10.1007/978-3-030-44081-7_15
Download citation
DOI: https://doi.org/10.1007/978-3-030-44081-7_15
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-44080-0
Online ISBN: 978-3-030-44081-7
eBook Packages: Computer ScienceComputer Science (R0)