Alias Resolution Based on ICMP Rate Limiting - Archive ouverte HAL Access content directly
Conference Papers Year : 2020

Alias Resolution Based on ICMP Rate Limiting

Abstract

Alias resolution techniques (e.g., Midar) associate, mostly through active measurement, a set of IP addresses as belonging to a common router. These techniques rely on distinct router features that can serve as a signature. Their applicability is affected by router support of the features and the robustness of the signature. This paper presents a new alias resolution tool called Limited Ltd. that exploits ICMP rate limiting, a feature that is increasingly supported by modern routers that has not previously been used for alias resolution. It sends ICMP probes toward target interfaces in order to trigger rate limiting, extracting features from the probe reply loss traces. It uses a machine learning clas-sifier to designate pairs of interfaces as aliases. We describe the details of the algorithm used by Limited Ltd. and illustrate its feasibility and accuracy. Limited Ltd. not only is the first tool that can perform alias resolution on IPv6 routers that do not generate monotonically increasing fragmentation IDs (e.g., Juniper routers) but it also complements the state-of-the-art techniques for IPv4 alias resolution. All of our code and the collected dataset are publicly available.
Fichier principal
Vignette du fichier
main.pdf (4.36 Mo) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-02513227 , version 1 (20-03-2020)

Identifiers

Cite

Kevin Vermeulen, Burim Ljuma, Vamsi Addanki, Matthieu Gouel, Olivier Fourmaux, et al.. Alias Resolution Based on ICMP Rate Limiting. PAM 2020 - 21st International Conference on Passive and Active Network Measurement, Mar 2020, Eugene, United States. pp.231-248, ⟨10.1007/978-3-030-44081-7_14⟩. ⟨hal-02513227⟩
145 View
100 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More