Detecting IPv4 Subnets in the Wild
TL;DR
This work exploits a peculiar behavior in certain router implementations, together with variations in the interpretation of protocol specifications, to infer prefix boundaries and thus prefix lengths through remotely probing the Internet with specially crafted ICMP Echo requests, and examines the uniformity of host responsiveness within autonomous systems and across subnet sizes.
Abstract
In this paper, we present methodologies based on two Internet Control Message Protocol (ICMP) message types to measure subnet deployments on the Internet. First, we exploit a peculiar behavior in certain router implementations, together with variations in the interpretation of protocol specifications, to infer prefix boundaries and thus prefix lengths through remotely probing the Internet with specially crafted ICMP Echo requests. Second, we evaluate the extent to which hosts continue to respond to the deprecated ICMP Address Mask request. We assess the applicability of these methods across devices from different network vendors and discuss protocol quirks that arise from lenient interpretations of the specifications. By combining both methods, we evaluate the consistency of our approach and present a dataset comprising 3.8M subnets. This dataset covers 15% of BGP announced prefixes across more than 20k autonomous systems. Using this dataset, we examine the uniformity of host responsiveness within autonomous systems and across subnet sizes, finding that smaller subnets tend to exhibit greater uniformity. Ultimately, our work demonstrates the feasibility of subnet inference, at a reasonable Internet scale.