PaperlayerView exact revision on arXiv

Source-linked AI summary

6SEVEN: System for EValuating IPv6 ENumeration algorithms

Chase Kanipe, Erik Rye, Dave Levin, Robert Beverly

arXiv:2609.08098v1cs.NI

TL;DR

Comparisons among IPv6 Target Generation Algorithms (TGAs) are hindered by inconsistent experimental controls and metrics. 6SEVEN provides a shared framework for evaluating eight TGAs; its case study finds performance metrics differ substantially across seed sets.

  • Problem

    TGA results are difficult to compare because evaluations lack common experimental controls and consistently reported metrics.

    Source: §4 · p. 4

  • Method

    6SEVEN provides an extensible framework with shared components for consistently implementing, running, and evaluating TGAs, including eight integrated algorithms.

    Source: §1 · p. 2

  • Results

    Performance metrics differ substantially between an existing hitlist and a client-rich NTP-based seed set, with substantial run-to-run variability for several TGA/seed combinations.

    Source: §1 · p. 2

  • Takeaways & Limitations

    6SEVEN supports controlled, head-to-head TGA comparisons and exposes sensitivity to methodological choices.

    Source: §1 · p. 2

    The case study uses ICMPv6 Echo Requests, so it does not evaluate how TGA performance varies with probe type.

    Source: §7 · p. 13

Abstract

from arXiv · show

The vast, sparsely populated, and often ephemeral IPv6 address space makes discovering active addresses challenging. In response, the community has developed over thirty different IPv6 Target Generation Algorithms (TGAs). TGAs learn addressing structure from seed (training) datasets, build a representative model, and generate candidate addresses. Unfortunately, the existing literature employs a wide variety of input seeds, data cleansing, and metrics of success that prevent ready comparison. Toward making TGA evaluation consistent, we present 6SEVEN, an extensible framework that hosts TGAs as plugins and links them to shared data cleaning, probing, dealiasing, and result tabulation components. We port as 6SEVEN plugins eight popular TGAs and demonstrate a controlled case study. Our results show that the performance of these TGAs varies substantially due to factors independent of the main algorithm---especially the seed set composition, dealiasing, and tabulation procedures. We observe tradeoffs between desirable features of TGA performance, including yield and exploration. We envision 6SEVEN as an enabling community resource to advance the science of current and future TGAs, and, by extension, IPv6 measurement.

1 Introduction

IPv6’s sparse address space makes active-address discovery difficult, and inconsistent TGA evaluation practices make results hard to compare. 6SEVEN provides a shared framework for controlled comparisons and is used to show that seeds and repeated trials matter.

1 Introduction

  • TGA studies use inconsistent metrics and methodological choices, making performance comparisons difficult and leaving no consensus on which algorithms perform best.Reported hit counts can differ in whether they include seeds or aliased addresses, and single-run evaluations are common despite TGAs’ probabilistic nature.Source: §1 · pp. 1–2
  • 6SEVEN decomposes TGA evaluation into interchangeable training, generation, scanning, dealiasing, and results-classification components for controlled head-to-head comparisons.The framework hosts plugins behind a common interface and provides shared functionality.Source: §1 · p. 2
  • The controlled case study evaluates eight TGAs and finds that performance metrics differ substantially between the IPv6 Hitlist and a client-rich NTP-based seed set.Shared pipeline components are held constant while outcome metrics are examined.Source: §1 · p. 2
  • Several TGA/seed combinations show substantial run-to-run variability, motivating multiple independent trials and explicit measures of dispersion.The paper also makes 6SEVEN and its implementations publicly available for future TGA evaluation.Source: §1 · p. 2

2 Background

IPv6 reconnaissance uses hitlists and TGAs to narrow an otherwise infeasible search. Hitlists, TGA designs, and aliased-prefix handling each shape what can be discovered and how results should be interpreted.

2 Background

  • Exhaustive IPv6 scanning is infeasible, so reconnaissance relies on hitlists and Target Generation Algorithms.TGAs learn address structure from seeds to predict additional active targets.Source: §2 · p. 2, §2.2 · p. 2

2.1 Hitlists

  • Hitlists collect responsive IPv6 addresses, but their source and network imbalances can limit representative coverage.The NTP-derived corpus contains more high-entropy, ephemeral end-host addresses than the IPv6 Hitlist.Source: §2.1 · p. 2

2.2 Target Generation Algorithms

  • TGA designs include static and dynamic generation, entropy-based methods, hierarchical clustering, generative models, and pattern migration.Dynamic TGAs use scan replies to refine their model, while pattern migration targets coverage gaps in seeded prefixes.Source: §2.2 · pp. 2–3
  • Hierarchical clustering methods can be sensitive to outlier seeds, and this paper focuses on general-purpose TGAs rather than task-specific ones.The taxonomy also includes speed-optimized, outlier-filtering, and pattern-based variants.Source: §2.2 · pp. 2–3

2.3 Aliased Prefixes

  • Aliased prefixes can attract probes and inflate apparent performance; offline lists miss newly aliased prefixes, whereas online methods probe multiple prefix lengths.6SEVEN marks a prefix aliased when at least two of three probes respond at a tested prefix length.Source: §2.3 · p. 3

3 Related Work

TGA comparisons often use different algorithms, seeds, and success measures, so published results do not establish a clear winner. Prior meta-analyses examined these factors, but left important structural questions and reusable evaluation infrastructure unresolved.

3.1 TGA Self-Comparisons

  • Published TGA comparisons use differing benchmark sets and methods, producing no clear winner and uncertainty about which algorithms are most useful to compare.Recent papers often compare against only a subset of prior TGAs.Source: §3.1 · p. 3

3.2 TGA Meta-Analyses

  • Steger et al. [38] and Williams et al. show that seed composition and evaluation criteria affect measured TGA performance, including yield, network diversity, and protocol responses.Williams et al. also report that aggregating multiple TGAs can yield a more representative Internet sample.Source: §3.2 · p. 4
  • Prior meta-analyses treat TGAs largely as black boxes and do not provide a released framework for later comparisons, leaving structural properties and component-level effects unresolved.The paper positions 6SEVEN as a framework for direct head-to-head comparison of existing and future TGAs.Source: §3.2 · p. 4

4 Comparing TGAs

TGA results lack a clear state-of-the-art comparison because methodological choices and reporting vary. The section models the pipeline and identifies tunable choices that affect evaluation outcomes.

4 Comparing TGAs

  • No clear state-of-the-art TGA has emerged amid incomparable results, parameterization, omitted details, and inconsistent experimental controls and metrics.These differences complicate interpretation and reproduction of TGA results.Source: §4 · p. 4

4.1 Canonical Model

  • The canonical evaluation model includes the seed, training and generation algorithm, scanner, alias detection and removal, and results processor.Seeds may be responsive IPv6 addresses, routing information, or DNS names.Source: §4.1 · p. 4
  • Differences in which responses count as hits and whether seed or duplicate responses are counted can substantially change metrics and obscure comparisons.Some systems count only replies from the probed address, while others also count incidental responses from peripheral routers.Source: §4.1 · p. 4

4.2 Parameterization

  • Tunable variables can affect results, yet papers often omit or conflict on implementation details, while comparisons across differing alias-removal and hit definitions remain unexamined.The section notes that algorithm choice has received more attention than these other factors.Source: §4.2 · pp. 4–5
  • Several tested TGAs reproduced seed addresses or duplicated candidate targets, both of which can affect reported evaluation metrics.Figure 3 presents the proportions of seed-reproduced and duplicate candidate addresses.Source: §4.2 · p. 5, Figure 3 · p. 5

5 6SEVEN

6SEVEN separates TGA-specific learning and generation from shared measurement components, enabling controlled evaluation. Its framework, plugins, and runtime support scanning and result processing, while plugin interfaces allow extension.

5 6SEVEN

  • 6SEVEN uses plugins for algorithm-specific learning and target generation, while shared framework and runtime components control surrounding evaluation variables.The three layers are the framework, plugins, and runtime.Source: §5 · pp. 5–6

5.1 Framework

  • The framework supplies shared probe construction, token validation, transmission, dealiasing, target exclusion, and canonical output; its scanner supports ICMPv6 Echo, TCP SYN, and UDP probes.Probe types and link-layer backends can be selected independently of target generation.Source: §5.1 · p. 6
  • The asynchronous runtime can accommodate connection-oriented scanning, but the current implementation has no connection-oriented probe types.Transmission and reception use the included scanner because it integrates with the framework feedback system.Source: §5.1 · p. 6

5.2 Plugins

  • A TGA implements training and enumerable target-space contracts; the initial release includes eight TGAs, while those unable to generate at least 10 million candidates with the seed sets were excluded.The eight are DET, Entropy/IP, 6Forest, 6GCVAE, 6Graph, 6Probe, 6Tree, and 6GAN.Source: §5.2 · p. 6

5.3 Runtime

  • The runtime dispatches generated targets to transmission workers and processes replies independently; it also supports streaming scan feedback or offline model updates.Decoupled generation, transmission, and reception can scale independently.Source: §5.3 · pp. 6–7

5.4 Extensibility

  • Additional TGAs can be added through Rust traits and loaded as dynamic libraries; the framework also supports Python plugins.The authors implemented their TGAs in Rust for consistency and performance.Source: §5.4 · p. 7

6 Results

The case study evaluates eight diverse TGAs trained on IPv6 Hitlist or NTP Pool seeds under shared probing settings. Results show that seed composition, response accounting, dealiasing, generation cost, and run variability all affect measured performance.

6.1.1 Address Response Types.

  • For Hitlist scans, Echo Replies were the majority for all TGAs except 6Probe, while about 40% of DET’s and 6Tree’s responses were ICMPv6 errors.For NTP Pool scans, errors dwarfed Echo Replies for most TGAs; some errors can reveal previously unseen routing assets.Source: §6.1.1 · pp. 7–9

6.1 Address Responsiveness

  • Across datasets, total raw-response rankings were similar, but NTP Pool seeds produced substantially fewer replies and proportionally more errors for most TGAs.Figure 4 compares ICMPv6 response types and codes across four runs per TGA.Source: §6.1.1 · pp. 7, 9, Figure 4 · p. 8

6.1.2 Responsive Address Regions.

  • With identical Hitlist seeds, Entropy/IP, 6Forest, and 6GCVAE generated visually distinct target maps; error and Echo Reply regions also often clustered separately.Entropy/IP showed dense error regions with few Echo Replies, while 6GCVAE generated dense regions absent from the seed map.Source: §6.1.2 · p. 9

6.2 Aliased Prefix Detection

  • For NTP Pool-seeded Entropy/IP and 6GCVAE outputs, IPv6 Hitlist offline filtering removed 99.6% and 97.5% of aliased addresses, respectively.6SEVEN probes each unique prefix at /48, /64, /96, /112, /116, and /120; it marks a prefix aliased if at least two of three probes receive an ICMPv6 Echo Reply.Source: §6.2 · pp. 9–10

6.3.1 Target Generation Yield.

  • 6GAN and 6GCVAE took several minutes to generate 10M targets, compared with under 10 seconds for tree- and entropy-based algorithms.At billion-target measurement scales, generation alone may take hours or days for more computationally intensive TGAs.Source: §6.3.1 · p. 10

6.3.2 Response Yield.

  • Hitlist-trained TGAs generally yielded more active addresses and new /48s, while NTP-trained 6GCVAE and 6GAN sometimes found none in a run, requiring repeated trials for confidence bounds.For error responders, 6Forest found an average of 71,000 new /48s with NTP Pool seeds versus 62,000 with Hitlist seeds.Source: §6.3.2 · pp. 10–11
  • Among Hitlist-trained TGAs, address overlap was generally below 10%, with 6Tree–DET at 27%; Entropy/IP and 6GAN shared 41% of discovered new /48s.For NTP-trained TGAs, address overlap was lower overall, with several exceptions in new /48 overlap.Source: §6.3.2 · p. 11
  • Evaluation choices materially shift apparent performance: hit definitions change what counts, online dealiasing can remove nearly all apparent hits, generation costs vary more than sixtyfold, and seed and run choices shift rankings.The authors caution that comparisons based on a single run, seed source, or hit definition may not generalize.Source: §6.3.2 · pp. 11–12

7 Experimental Limitations

The case study has bounded scope: it does not exhaustively explore 6SEVEN’s parameter space or identify a state-of-the-art TGA. Its measurements also leave several experimental conditions fixed or limited, while reimplementation may differ from the original algorithms.

7 Experimental Limitations

  • The study makes no claim about which TGA is state of the art, and leaves an in-depth comparison to future work.Its results also do not exhaustively explore the parameter space available in 6SEVEN.Source: §7 · pp. 12–13
  • The case study issued at most 10M probes, used a fixed training-data size, and did not vary probe rate.The probing rate was 10,000 packets per second, chosen to avoid ICMPv6 rate limiting and undue burden on probed networks.Source: §7 · p. 13
  • The NTP Pool training set was more skewed toward APNIC than the IPv6 Hitlist set, potentially affecting generated targets.APNIC represented 76% of NTP Pool seeds and 36% of IPv6 Hitlist seeds.Source: §7 · p. 13
  • The case study used ICMPv6 Echo Requests only, so it did not test how TGA performance varies with probe type.6SEVEN also supports TCP SYN and UDP probing.Source: §7 · p. 13
  • Measurements came from a single cloud-based vantage point.The study does not vary vantage point selection.Source: §7 · p. 13
  • The evaluation treats each TGA as a black box, and reimplementation may have introduced differences from the original algorithms.The study therefore does not evaluate the internal learning and generation mechanisms that drive TGA performance.Source: §7 · p. 13

8 Conclusions and Future Work

The paper presents 6SEVEN as a modular framework for comparing TGAs while controlling evaluation variables, addressing the lack of a common process for comparison. Its case study finds important methodological sensitivities, while future work includes exploring TGA behavior and adding plugins; the scans followed specified precautions.

8 Conclusions and Future Work

  • 6SEVEN is a modular framework for implementing and comparing TGAs while controlling variables that can affect performance.The paper motivates the framework by noting that comparative understanding requires control of variables, parameterizations, and implementation details independent of the TGA itself.Source: §8 · p. 13
  • The case study compared eight TGAs across metrics using IPv6 Hitlist and NTP Pool seeds, whose compositions differ substantially.The paper defers deeper investigation of why different TGAs or TGA families learn different kinds of addresses from different seed datasets.Source: §8 · p. 13, §8.1 · p. 13
  • TGA performance varied across repeated scans, and omitting online aliased-prefix detection could substantially inflate hit counts.The study also found differences between offline alias removal and online detection, substantial computational-cost differences among TGAs, and useful information in ICMPv6 error responses that some systems discard.Source: §8 · p. 13

8.1 Future Work

  • Future work includes implementing additional TGAs as 6SEVEN modules to support ready comparisons with shared independent variables.The framework is envisioned as a resource for advancing TGA research and IPv6 measurement.Source: §8.1 · p. 13, §8 · p. 13

A Ethics

  • The scans randomized probe order, used ICMPv6 at 10,000 packets per second, and provided a web page for scan opt-outs.The authors report receiving no opt-out requests.Source: A Ethics · p. 16

B Seed Training Data

The seed-data description specifies four 1M-address training rounds drawn from a 10M-address universe across the NTP Pool and IPv6 Hitlist. The implementation notes document how each TGA was parameterized or integrated with shared scanning and dealiasing components.

B Seed Training Data

  • The seed-data table describes dataset composition by RIR and interface-identifier type, while training used four 1M-seed rounds sampled from a 10M-address universe.The universe combined NTP Pool collection addresses and IPv6 Hitlist addresses; the table percentages use each dataset’s total, with totals combining the four rounds.Source: B Seed Training Data · p. 16, Table 4 · p. 16

C.1 Entropy/IP

  • Entropy/IP was implemented with entropy segmentation, segment mining, and Bayesian-network learning; the parent count was left unconstrained.The implementation disabled --rcode because unknown segment states could generate values that could not be decoded into concrete IPv6 targets.Source: §C.1 · p. 16

C.2 DET

  • DET used the released code’s radix-16 representation and leaf-splitting threshold, with dealiasing applied through the shared pipeline.The released dynamic scanner did not fully specify alias handling, so DET target generation was kept separate from dealiasing.Source: §C.2 · p. 16

C.3 6Forest

  • 6Forest followed the released code’s last-in worklist scheduling and leftmost split fallback rather than the paper’s described scheduling.The fallback applies when coverage gain is below its threshold.Source: §C.3 · p. 16

C.4 6Graph

  • 6Graph’s available implementation covered pattern mining and target generation, so measurement used shared scanning and dealiasing.The paper describes additional scan-time mechanisms, including an adaptive loop, seed rejoining, and per-round budgets.Source: §C.4 · p. 16

C.5 6Probe

  • 6Probe used the released DHC stopping rule with a duplicate-only-node guard, then expanded low-dimensional patterns into targets for shared dealiasing.The guard prevents duplicate-only nodes from blocking progress.Source: §C.5 · p. 16

C.6 6Tree

  • 6Tree used the released code’s radix-16 address representation.The paper treats the vectorization radix as an algorithm parameter; the reference code fixes it to hexadecimal nibbles.Source: §C.6 · p. 16

C.7 6GAN

  • 6GAN followed explicit model and hyperparameter choices from the paper and used released-code details where the paper was underspecified.Alias removal was evaluated as a separate shared measurement stage.Source: §C.7 · p. 16

D Training Parameterization

The section identifies Table 5 as the default 6SEVEN training parameterization.

D Training Parameterization

  • Table 5 presents the default 6SEVEN training parameterization.The supplied passage does not specify the parameter values.Source: Table 5 · p. 17

E TGA Summary Table

The table compiles TGA seed sources and reported outcome metrics, reproducing each paper’s values and marking unreported or inapplicable quantities with a dash.

E TGA Summary Table

  • 6Map’s row lists Hitlist and 23–37% at 100M, while 6Probe’s row reports percentage ranges of 0.8–46.7%, 0.4–2.7%, and 97.3–99.6%.The table also lists Hitlist as a seed source for both TGAs.Source: E TGA Summary Table · p. 18, Table 6 · p. 18
  • Helixir’s listed configuration includes BGP and Hitlist seeds, 100M/DS, and an ICMP-error filter.The row also reports 227.8K prefixes and 1.15M /48.Source: E TGA Summary Table · p. 18, Table 6 · p. 18
  • RGen, SubRecon, and TopoHunter rows report 58.0%, 28.5M (0.56%), and 1.97M /48, respectively, alongside their listed seed sources.The seeds shown are Hitlist, BGP and Hitlist, and RouteViews and Hitlist, respectively.Source: E TGA Summary Table · p. 18, Table 6 · p. 18

F Additional Hilbert Projections

Figure 9 shows Hilbert projections for the remaining Hitlist-seeded TGAs, using the same pipeline stages and visual encoding as Figure 5.

F Additional Hilbert Projections

  • Figure 9 applies Figure 5’s pipeline stages and visual encoding to Hilbert projections of the remaining Hitlist-seeded TGAs.The caption identifies the scope and shared encoding but does not state a comparative outcome.Source: Figure 9 · p. 19
Loading 2609.08098v1…