Punching Bag: A Tool for Testing IPv6 Scans and Target Generation Algorithms

Abstract

Scanning the IPv6 address space exhaustively is infeasible. Besides hitlists with known active addresses, Target Generation Algorithms (TGAs) are a common tool for generating input for IPv6 measurements. They generate candidate addresses based on known responsive addresses using address patterns or machine learning. Some TGAs additionally use active scans during address generation as feedback mechanisms. However, the Internet is a changing ecosystem and scans can be impacted by network events, e.g., rate limits. These effects impact TGA results, a proper evaluation of their quality and benefit, and the comparability of TGAs. We propose an IPv6 Punching Bag, a local environment to test IPv6 scans and TGAs before actually using them on the Internet. It allows configuring prefixes with different response rates, e.g., aliased prefixes, or address patterns. It can be used on a single machine with a low memory footprint. We evaluate six dynamic TGAs with the Punching Bag and show that their adherence to scanning budgets and limits, and their inability to detect aliased prefixes necessitates local tests before Internet scans. We also demonstrate that 6Scan, a dynamic TGA, is not adapting to different response behavior.