Gungnir: Autoregressive Model for Unified Generation of IPv6 Fully Responsive Prefixes

With the widespread adoption of IPv6, its vast address space presents significant challenges for network asset discovery. Traditional exhaustive scanning approaches are no longer practical, while strategies based on target generation algorithms are increasingly undermined by the existence of Fully Responsive Prefixes (FRPs)—prefixes in which all addresses appear responsive to probing. FRPs distort scanning results, introducing bias and inefficiency. Existing FRP probing techniques suffer from limited scalability, poor accuracy, and restricted applicability in large-scale IPv6 environments.To this end, we propose Gungnir, a multi-protocol unified FRP probing algorithm based on autoregressive semantic modeling. Gungnir captures the intricate relationships between FRP patterns and their influencing factors through a deep semantic learning architecture. It leverages prefix inference and a granularity correction mechanism to accurately predict and validate FRPs, while mitigating errors from incorrect prefix-length estimation. Extensive experiments demonstrate that Gungnir outperforms state-of-the-art techniques, achieving up to 27× higher efficiency, 4.2× wider address space coverage, and broader coverage of both autonomous systems and routing prefixes under the same probing budget. Beyond performance, we further analyze the service and port distributions of the discovered FRPs, uncovering operational patterns and potential security implications. These insights offer valuable guidance for IPv6 measurement, address discovery, and network defense.