APPLE: Alias Pruning by Path Length Estimation

Abstract

Uncovering the Internet’s router graph is vital to accurate measurement and analysis. In this paper, we present a new technique for resolving router IP aliases that complements existing techniques. Our approach, Alias Pruning by Path Length Estimation (apple), avoids relying on router manufacturer and operating system specific implementations of IP. Instead, it filters potential router aliases seen in traceroute by comparing the reply path length from each address to a distributed set of vantage points.

We evaluated our approach on Internet-wide collections of IPv4 and IPv6 traceroutes. We compared apple’s router alias inferences against router configurations from two R&E networks, finding no false positives. Moreover, apple’s coverage of the potential alias pairs in the ground truth networks rivals the current state-of-the-art in IPv4, and far exceeds existing techniques in IPv6. We also show that apple complements existing alias resolution techniques, increasing the total number of inferred alias pairs by 109.6% in IPv4, and by 1071.5% in IPv6.

A Generalizing the Birthday Problem to Alias Resolution

The birthday problem computes the probability that any combination of n people share the same birthday. A common approximate general solution [23] takes the form,

$$\begin{aligned} p(n,d) \approx 1 - \exp \left( \frac{n(n-1)}{2d}\right) , \end{aligned}$$

where d is the number of days in the year. Of note, the $\frac{n(n-2)}{2}$ term corresponds to the number of possible two-person combinations. Using a to represent the number of combinations, the equation takes the form,

$$\begin{aligned} p(a,d) \approx 1 - \exp \left( \frac{a}{d}\right) . \end{aligned}$$

Applying this equation to our problem, we first replace the number of combinations with the number of potential alias pairs. Second, we must determine the potential reply space for each address. When an address replies to a VP, the VP sees a reply TTL from the space of possible reply TTLs, r. If we assume that a reply TTL to one VP is independent of all the others, then the potential reply space for an address is $r^v$. Practically, we consider $r^v$ an upper bound on the possible combinations, since we expect that the network topology and control plane create dependent probabilities. Plugging $r^v$ in for d we get the approximate probability that a pair of addresses will have the same combination of replies to all v VPs,

$$\begin{aligned} p(a,r,v) \approx 1 - \exp \left( \frac{a}{r^v}\right) . \end{aligned}$$

To limit collisions, while maximizing the number of true alias pairs, we use the smallest value of v such that $p(a,r,v) < 1/a$.