Panoptic IPv6 Measurement : Debiasing Hitlists for Internet-wide Surveys and Remote Monitoring Detection

Abstract: Active Internet measurements survey online hosts on a global scale. Its applications are numerous and include tracking protocol adoption, discovering vulnerabilities, and detecting network disruptions. Because of the vast address space, exhaustively targeting all IP addresses is not feasible in IPv6. For this reason, researchers have to utilize lists of known addresses as a sample of the Internet. In this work, we evaluate the effectiveness of these hitlists as an input for active measurements and apply Internet-wide scanning to assess the extent of monitoring on the IPv6-Internet. We examine existing address sources and propose two new sources that draw addresses from peer-to-peer networks. We take the BitTorrent distributed hash table as a case study and amass 42.8 million unique IPv6 addresses. In addition, we find significant bias in the representation of autonomous systems and prefix length in a major public hitlist. Our active measurements show evidence of extensive sharing of probes among autonomous systems. Among all networks, academic and research networks prove to be the most actively monitored.