Alias Resolution Based on ICMP Rate Limiting - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

Alias Resolution Based on ICMP Rate Limiting

Résumé

Alias resolution techniques (e.g., Midar) associate, mostly through active measurement, a set of IP addresses as belonging to a common router. These techniques rely on distinct router features that can serve as a signature. Their applicability is affected by router support of the features and the robustness of the signature. This paper presents a new alias resolution tool called Limited Ltd. that exploits ICMP rate limiting, a feature that is increasingly supported by modern routers that has not previously been used for alias resolution. It sends ICMP probes toward target interfaces in order to trigger rate limiting, extracting features from the probe reply loss traces. It uses a machine learning clas-sifier to designate pairs of interfaces as aliases. We describe the details of the algorithm used by Limited Ltd. and illustrate its feasibility and accuracy. Limited Ltd. not only is the first tool that can perform alias resolution on IPv6 routers that do not generate monotonically increasing fragmentation IDs (e.g., Juniper routers) but it also complements the state-of-the-art techniques for IPv4 alias resolution. All of our code and the collected dataset are publicly available.
Fichier principal
Vignette du fichier
main.pdf (4.36 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-02513227 , version 1 (20-03-2020)

Identifiants

Citer

Kevin Vermeulen, Burim Ljuma, Vamsi Addanki, Matthieu Gouel, Olivier Fourmaux, et al.. Alias Resolution Based on ICMP Rate Limiting. PAM 2020 - 21st International Conference on Passive and Active Network Measurement, Mar 2020, Eugene, United States. pp.231-248, ⟨10.1007/978-3-030-44081-7_14⟩. ⟨hal-02513227⟩
141 Consultations
98 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More