Revisiting and Expanding the IPv6 Periphery: Global-Scale Measurement and Security Analysis

Abstract

As IPv6 deployment accelerates, understanding the evolving security posture of network peripheries becomes increasingly important. A DSN 2021 study first explored IPv6 network peripheries, but its scope was limited to three regions and is now outdated. In this paper, we revisit and expand that work through a global-scale measurement and security analysis of IPv6 network peripheries. To support efficient large-scale scanning, we propose a novel Response-Guided Prefix Selection (RGPS) strategy to identify high-value IPv6 prefixes for probing. Our measurement covers 73 countries/regions and identifies over 281.9M active IPv6 network peripheries, including a 364.8% increase over the 2021 baseline in India, China, and America. We further analyze exposed services and find that 2.5% of devices expose at least one measured service, with recurring software vulnerabilities indicated by version-to-CVE mappings. As a case study of emerging exposed services, we design a Hierarchical LLM Exposure Verification (HLEV) framework to identify unauthorized-access risks in LLM deployment tools. Finally, we revisit routing loop vulnerabilities and identify 4.5M loop-prone devices, showing that flawed routing behaviors remain widespread. These findings indicate that although IPv6 adoption has surged, key security challenges persist across network peripheries.