arXiv subjects

Paul Pearce

Publications and source records attributed to Paul Pearce.

6 recordsLinked to original sources

arXiv2026

Detecting and Characterizing Massively Shared IP Addresses

IP addresses are commonly shared across devices and users for a variety of reasons, including NAT and proxies. These technologies operate at different scales, from residential NATs that share an IP address across devices in a home to large-scale Carrier Grade NATs that share hundreds or thousands of users on a single IP. Cases of large-scale IP sharing are distinct as they have significant implications for IP-based mechanisms such as attribution, blocklisting, and rate-limiting, where the consequences of mishandling affect a large quantity of end-users and organizations. In this work, we detect and characterize IP addresses shared at large scales, which we coin massively shared. Leveraging diurnal patterns in traffic shape, we use data from a large CDN to characterize these IPs globally. We broadly find that massive IP sharing is responsible for a large fraction of IPv4 traffic, concentrated in a small fraction of address space, with over 40% of total traffic coming from less than 2% of active IP addresses. We observe distinct patterns in deployment geographically, with particularly high rates of massively shared traffic from some smaller countries. Comparatively, in IPv6, we find far fewer massively shared addresses with some surprising exceptions among mobile providers. We additionally contextualize these addresses by other network characteristics, including identifying cellular connectivity and dual-stack capabilities, and identifying several instances of massively shared IPs in proxy services hosted on cloud networks. Finally, we find that rates of massively shared traffic are increasing over time, predicting future reliance on these technologies. Our work contextualizes the state of IP sharing, providing a uniquely broad perspective globally.

cs.NI↗

arXiv2024

Understanding Routing-Induced Censorship Changes Globally

Internet censorship is pervasive, with significant effort dedicated to understanding what is censored, and where. Prior censorship work however have identified significant inconsistencies in their results; experiments show unexplained non-determinism thought to be caused by censor load, end-host geographic diversity, or incomplete censorship -- inconsistencies which impede reliable, repeatable and correct understanding of global censorship. In this work we investigate the extent to which Equal-cost Multi-path (ECMP) routing is the cause for these inconsistencies, developing methods to measure and compensate for them. We find ECMP routing significantly changes observed censorship across protocols, censor mechanisms, and in 17 countries. We identify that previously observed non-determinism or regional variations are attributable to measurements between fixed end-hosts taking different routes based on Flow-ID; i.e., choice of intra-subnet source IP or ephemeral source port leads to differences in observed censorship. To achieve this we develop new route-stable censorship measurement methods that allow consistent measurement of DNS, HTTP, and HTTPS censorship. We find ECMP routing yields censorship changes across 42% of IPs and 51% of ASes, but that impact is not uniform. We identify numerous causes of the behavior, ranging from likely failed infrastructure, to routes to the same end-host taking geographically diverse paths which experience differences in censorship en-route. Finally, we explore our results in the context of prior global measurement studies, exploring first the applicability of our findings to prior observed variations, and then demonstrating how specific experiments from two studies could be impacted by, and specific results are explainable by, ECMP routing. Our work points to methods for improving future studies, reducing inconsistencies and increasing repeatability.

cs.NI↗

arXiv2024

A First Look At NAT64 Deployment In-The-Wild

IPv6 is a fundamentally different Internet Protocol than IPv4, and IPv6-only networks cannot, by default, communicate with the IPv4 Internet. This lack of interoperability necessitates complex mechanisms for incremental deployment and bridging networks so that non-dual-stack systems can interact with the whole Internet. NAT64 is one such bridging mechanism by which a network allows IPv6-only clients to connect to the entire Internet, leveraging DNS to identify IPv4-only networks, inject IPv6 response addresses pointing to an internal gateway, and seamlessly translate connections. To date, our understanding of NAT64 deployments is limited; what little information exists is largely qualitative, taken from mailing lists and informal discussions. In this work, we present a first look at the active measurement of NAT64 deployment on the Internet focused on deployment prevalence, configuration, and security. We seek to measure NAT64 via two distinct large-scale measurements: 1) open resolvers on the Internet, and 2) client measurements from RIPE Atlas. For both datasets, we broadly find that despite substantial anecdotal reports of NAT64 deployment, measurable deployments are exceedingly sparse. While our measurements do not preclude the large-scale deployment of NAT64, they do point to substantial challenges in measuring deployments with our existing best-known methods. Finally, we also identify problems in NAT64 deployments, with gateways not following the RFC specification and also posing potential security risks.

cs.NI↗

arXiv2023

ZDNS: A Fast DNS Toolkit for Internet Measurement

Active DNS measurement is fundamental to understanding and improving the DNS ecosystem. However, the absence of an extensible, high-performance, and easy-to-use DNS toolkit has limited both the reproducibility and coverage of DNS research. In this paper, we introduce ZDNS, a modular and open-source active DNS measurement framework optimized for large-scale research studies of DNS on the public Internet. We describe ZDNS' architecture, evaluate its performance, and present two case studies that highlight how the tool can be used to shed light on the operational complexities of DNS. We hope that ZDNS will enable researchers to better -- and in a more reproducible manner -- understand Internet behavior.

cs.NI↗

arXiv2022

Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild

In this work we identify scanning strategies of IPv6 scanners on the Internet. We offer a unique perspective on the behavior of IPv6 scanners by conducting controlled experiments leveraging a large and unused /56 IPv6 subnet. We selectively make parts of the subnet visible to scanners by hosting applications that make direct or indirect contact with IPv6- capable servers on the Internet. By careful experiment design, we mitigate the effects of hidden variables on scans sent to our /56 subnet and establish causal relationships between IPv6 host activity types and the scanner attention they evoke. We show that IPv6 host activities e.g., Web browsing, membership in the NTP pool and Tor network, cause scanners to send a magnitude higher number of unsolicited IP scans and reverse DNS queries to our subnet than before. DNS scanners focus their scans in narrow regions of the address space where our applications are hosted whereas IP scanners broadly scan the entire subnet. Even after the host activity from our subnet subsides, we observe persistent residual scanning to portions of the address space that previously hosted applications

cs.NI↗

arXiv1995

SOLUTION OF FUNCTIONAL EQUATIONS OF RESTRICTED $A_{n-1}^{(1)}$ FUSED LATTICE MODELS

Functional equations, in the form of fusion hierarchies, are studied for the transfer matrices of the fused restricted $A_{n-1}^{(1)}$ lattice models of Jimbo, Miwa and Okado. Specifically, these equations are solved analytically for the finite-size scaling spectra, central charges and some conformal weights. The results are obtained in terms of Rogers dilogarithm and correspond to coset conformal field theories based on the affine Lie algebra $A_{n-1}^{(1)}$ with GKO pair $A^{(1)}_{n-1}\; \oplus A^{(1)}_{n-1}\;\supset \; A^{(1)}_{n-1}$.

hep-th↗