Efficient internet-wide IPv6 router interface discovery and service analysis

Abstract Understanding Internet topology is crucial for network measurement and security assessment. Although the methods used for active topology discovery in the IPv6 Internet are similar to those for IPv4, the vast and sparsely populated IPv6 address space makes relying solely on brute-force traceroute impractical for efficiently uncovering the IPv6 topology, including both its breadth and depth. In this work, we introduce a fast IPv6 topology discovery tool called HRoute6, which incorporates real-time scan direction adjustments based on prior scan results. By dynamically adapting its scanning strategy, HRoute6 directs more probes towards prefixes where more router interfaces have been discovered along the paths. Real-world experiments confirm that HRoute6 significantly enhances discovery efficiency, surpassing current state-of-the-art methods by a considerable margin of 5.26$\times $ to 19.77$\times $ in scans with a probing budget of 50 M-scale or more. To support the IPv6 research community, we are providing access to both our tool and the collected IPv6 router interfaces we have discovered. Grounded on the found router addresses, we perform rapid service probing and evaluate three prediction systems in real-world IPv6 environments. For practitioners, we recommend adopting a hybrid scanning strategy that balances efficiency and coverage. Additionally, we found that IPv6 routers expose more potential threats through certain open applications, urging network administrators to remain vigilant.