A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP Signals
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866918141877026816 |
|---|---|
| author | Egloff, Isabell Hiesgen, Raphael Koch, Maynard Schmidt, Thomas C. Wählisch, Matthias |
| author_facet | Egloff, Isabell Hiesgen, Raphael Koch, Maynard Schmidt, Thomas C. Wählisch, Matthias |
| contents | Scanners are daily visitors of public IPv4 hosts. Scanning IPv6 nodes successfully is still a challenge, which an increasing crowd of actors tries to master. In this paper, we analyze current IPv6 scanning under various network conditions. We observe scanner behavior during eleven months in four network telescopes, one of which is periodically reconfigured by changing BGP announcements. We analyze and classify the observed scanners w.r.t. their temporal behavior, their target, and network selection strategy, as well as their individual tools, fingerprints, and correlations across categories. We find that silent subnets of larger prefixes remain invisible, whereas BGP prefix announcements quickly attract attention by scanners. Based on our findings, we derive operational guidance on how to deploy network telescopes to increase visibility of IPv6 scanners. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2506_20383 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP Signals Egloff, Isabell Hiesgen, Raphael Koch, Maynard Schmidt, Thomas C. Wählisch, Matthias Networking and Internet Architecture Scanners are daily visitors of public IPv4 hosts. Scanning IPv6 nodes successfully is still a challenge, which an increasing crowd of actors tries to master. In this paper, we analyze current IPv6 scanning under various network conditions. We observe scanner behavior during eleven months in four network telescopes, one of which is periodically reconfigured by changing BGP announcements. We analyze and classify the observed scanners w.r.t. their temporal behavior, their target, and network selection strategy, as well as their individual tools, fingerprints, and correlations across categories. We find that silent subnets of larger prefixes remain invisible, whereas BGP prefix announcements quickly attract attention by scanners. Based on our findings, we derive operational guidance on how to deploy network telescopes to increase visibility of IPv6 scanners. |
| title | A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP Signals |
| topic | Networking and Internet Architecture |
| url | https://arxiv.org/abs/2506.20383 |