IPv6 Prefixes Research Articles

Root Mirror Sites Identification and Service Area Analysis

The operation of today’s Internet can only be achieved with the domain name system (DNS), and the essential part of the DNS is the root servers. Adding anycast mirrors has been used to maintain the security of root servers, but many problems accompany this technique. In this paper, we used 36198 probe points deployed worldwide to probe 1160 root mirror sites and analyzed the data with root mirrors’ identification and localization (RMIL). RMIL is a method to identify and locate root mirrors. It contains probing and analyzing the network services ID (NSID) and traceroute data to identify and locate root mirror sites. Using this method, 821 (70.78% of the total) sites were accurately identified and located, and city-level localization was achieved for 281 other sites. Finally, the identification results were used in the service area analysis. The analysis contained multiple dimensions: locations, autonomous system numbers (ASN), internet service providers (ISP), and IPV4 prefixes. As such, we helped identify and locate root mirror sites more precisely and discover which ones have a greater service area in different dimensions.

Surgical DDoS Filtering With Fast LPM

Can software-based packet filters effectively dampen volumetric distributed denial-of-service (DDoS) streams in an era when 10 Gbps links are considered slow? The potential of longest prefix matching (LPM) for enforcing precise DDoS scrubbing policies seems to be overlooked in contemporary packet filtering datapaths, and in this paper, we argue that this should not be the case by showing that effective whitelist / blacklist LPM-based filtering can be performed with commodity hardware. A showcase datapath we propose can evaluate multiple queries in large separate LPM databases for each forwarded 64-byte packet, while sustaining 10 Gbps line rate on a single CPU core, with a healthy scaling potential due to its lockless architecture and small memory footprint of LPM structures. We demonstrated forwarding 64 million packets per second using only six CPU cores while performing independent lookups for each packet in three large LPM databases created by aggregating malicious IP addresses or by mapping different geolocation identifiers to IPv4 prefixes.

Addressless: A new internet server model to prevent network scanning.

Eliminating unnecessary exposure is a principle of server security. The huge IPv6 address space enhances security by making scanning infeasible, however, with recent advances of IPv6 scanning technologies, network scanning is again threatening server security. In this paper, we propose a new model named addressless server, which separates the server into an entrance module and a main service module, and assigns an IPv6 prefix instead of an IPv6 address to the main service module. The entrance module generates a legitimate IPv6 address under this prefix by encrypting the client address, so that the client can access the main server on a destination address that is different in each connection. In this way, the model provides isolation to the main server, prevents network scanning, and minimizes exposure. Moreover it provides a novel framework that supports flexible load balancing, high-availability, and other desirable features. The model is simple and does not require any modification to the client or the network. We implement a prototype and experiments show that our model can prevent the main server from being scanned at a slight performance cost.

Addressless: Enhancing IoT Server Security Using IPv6

Nowadays more and more IoT devices, including a large number of IoT servers, have been deployed on the Internet. The security of IoT servers has always been a challenge. In this paper, a new model named addressless IoT server is proposed, which allows people to use the large IPv6 address space to protect IoT server security. The server is allocated an IPv6 prefix instead of an address. When the authenticated client initiates communication, it uses an encryption mechanism to generate a specific destination address under the prefix. The server verifies the destination address when receiving the packet, and discards the packet if the verification fails. In this way, the model can prevent attackers from perceiving the server and launching scans or attacks, while remains compatible with the current Internet. The prototype is implemented and an extensive set of experiments are conducted in this paper. The results demonstrate that the model can better protect server security.

Helix: IP lookup scheme based on helicoidal properties of binary trees

In this paper, we propose an IP lookup scheme, called Helix, that performs parallel prefix matching at the different prefix lengths and uses the helicoidal properties of binary trees to reduce tree height. The reduction of the tree height is achieved without performing any prefix modification. Helix minimizes the amount of memory used to store long and numerous prefixes and achieves IP lookup and route updates in a single memory access. We evaluated the performance of Helix in terms of the number of memory accesses and amount of memory required for storing large IPv4 and IPv6 routing tables with up to 512,104 IPv4 and 389,956 IPv6 prefixes, respectively. In all the tested routing tables, Helix performs lookup in a single memory access while using very small memory amounts. We also show that Helix can be implemented on a single field-programmable gate array (FPGA) chip with on-chip memory for the IPv4 and IPv6 tables considered herein, without requiring external memory. Specifically, Helix uses up to 72% of the resources of an FPGA to accommodate the most demanding routing table, without performance penalties. The implementation shows that Helix may achieve lookup speeds beyond 1.2 billion packets per second (Gpps).

Design and Optimization of Hierarchical Routing Protocol for 6LoWPAN

To build scalable and lightweight wireless sensor networks with energy saving devices, 6LoWPAN-based protocols become emergent technologies that successfully constructed ubiquitous networks and seamlessly connected the traditional Internet with WSNs. However, the existing researches cannot effectively maintain the routing and the network topology for the problems of low cost sensors' malfunctions. In this paper, we improved the HiLow protocol in aspects of interconnection between the Internet and 6LoWPAN and designed a network routing path recovery approach. In addition, we designed and modified the address mapping table in gateway to store and map nodes' EUI-64 address and 16-bit short address. Nodes from the Internet can access the 6LoWPAN nodes by an IPv6 address, which is generated by the EUI-64 address and IPv6 prefix. Due to the benefits of additional data structure and our designs, the simulation results manifested that our protocol improves the routing efficiency and can effectively reduce the cost for network reorganization caused by node failures and mobiles.

Evolving the 3GPP bearer model towards multiple IPv6 prefixes and next-hop routers

The 3GPP architecture is not particularly IPv6 friendly when it comes to handling of multiple prefixes. The excess use of default bearers and related radio access bearers to mimic multi-addressing is not efficient, resource-wise. This paper proposes to enhance the existing Evolved Packet System bearer model to allow a bearer to have multiple IPv6 prefixes as well as multiple next-hop routers for the sake of a better network controlled traffic steering. The solution has a minimal delta to the existing 3GPP system architecture and offers excellent migration path to the new functionality. While the proposed solution advocates local traffic breakouts and use of localized network resources along with multi-addressing, it does not even attempt to change the Packet Data Network Gateway centric mobility management nature of the 3GPP architecture. The enhancements on the bearer model are based on the design principle that IPv6 prefixes meant for localized network access do not need mobility, thus reducing the amount of system level signaling during mobility events. The solution works only for IPv6, while the existing IPv4 functionality is kept intact. This paper describes in detail the new bearer model, including an extensive discussion of how IPv6 is supposed to be implemented on top of it, and analyzes the impact of required changes and the backward compatibility with the existing Evolved Packet System.

Tree-Combined Trie: A Compressed Data Structure for Fast IP Address Lookup

For meeting the requirements of the high-speed Internet and satisfying the Internet users, building fast routers with high-speed IP address lookup engine is inevitable. Regarding the unpredictable variations occurred in the forwarding information during the time and space, the IP lookup algorithm should be able to customize itself with temporal and spatial conditions. This paper proposes a new dynamic data structure for fast IP address lookup. This novel data structure is a dynamic mixture of trees and tries which is called Tree-Combined Trie or simply TC-Trie. Binary sorted trees are more advantageous than tries for representing a sparse population while multibit tries have better performance than trees when a population is dense. TC-trie combines advantages of binary sorted trees and multibit tries to achieve maximum compression of the forwarding information. Dynamic reconfiguration of TC-trie, made it capable of customizing itself along the time and scaling to support more prefixes or longer IPv6 prefixes. TC-trie provides a smooth transition from current large IPv4 databases to the large IPv6 databases of the future Internet.

DXR

Can a software routing implementation compete in a field generally reserved for specialized lookup hardware? This paper presents DXR, an IPv4 lookup scheme based on transforming large routing tables into compact lookup structures which easily fit into cache hierarchies of modern CPUs. DXR supports various memory/speed tradeoffs and scales almost linearly with the number of CPU cores. The smallest configuration, D16R, distills a real-world BGP snapshot with 417,000 IPv4 prefixes and 213 distinct next hops into a structure consuming only 782 Kbytes, less than 2 bytes per prefix, and achieves 490 million lookups per second (MLps) in synthetic tests using uniformly random IPv4 keys on a commodity 8-core CPU. Some other DXR configurations exceed 700~MLps at the cost of increased memory footprint. DXR significantly outperforms a software implementation of DIR-24-8-BASIC, has better scalability, and requires less DRAM bandwidth. Our prototype works inside the FreeBSD kernel, which permits DXR to be used with standard APIs and routing daemons such as Quagga and XORP, and to be validated by comparing lookup results against the BSD radix tree.

ServBGP: BGP-inspired autonomic service routing for multi-provider collaborative architectures in the cloud

In this paper we propose the design and implementation of ServBGP, a service routing protocol for managing service collaboration among cloud providers in cloud computing. ServBGP is based on the policy-driven design of the well-known BGP Internet routing protocol to support the different service interaction models currently employed in the cloud particularly the monolithic, composite, and broker-based service models. The main contribution of this work lies in devising a system that autonomously manages the different aspects of service interaction and collaboration among service providers from service discovery and advertisement to service consumption and revocation. The ServBGP routing decision engine is designed to operate by (1) processing cost-bidding service advertisement and revocation messages from the different cloud providers and (2) extracting objective and trustworthy feedback which is maintained by certified network entities and which consists of a set of reputation scores related to quality of service, security, and pricing. The BGP-inspired design choice allows the proposed system to “stand upon the shoulders of giants” by relying on a time-tested protocol that currently supports scalable inter-domain routing services among over 120,000 IPv4 prefixes in the Internet. Moreover, reusing the decision logic of the standard BGP protocol aids in reducing the development and operational costs, hence shortening the time to market, and utilizing a large set of BGP extensions, particularly, in the security domain, that have been incorporated into BGP since its inception in 1989. These qualities are of a chief importance in the cloud community today to ensure the efficient and secure service collaboration among cloud providers and to support the evolution, scalability, and economic feasibility of the overall cloud computing infrastructure. A proof of concept implementation of the ServBGP design is realized on the NetKit network emulation and virtualization platform using the standard BGPv4 protocol. Moreover, the devised ServBGP design is developed from the ground up and deployed in a real cloud computing environment using Amazon EC2, Microsoft Azure, and Google App Engine cloud platforms.

Multiprefix Trie: A New Data Structure for Designing Dynamic Router-Tables

IP lookup affects the speed of an incoming packet and the time required to determine which output port the packet should be sent to; hence, it plays an important role in the design of router-tables. In this paper, we propose a new data structure, called a multiprefix trie, for use in designing dynamic router-tables. One key feature of our data structure is that each node can store more than one prefix, which reduces the number of memory accesses. When performing lookup, the structure can search more prefixes in one node and may find the longest matching prefix in an internal node rather than on a leaf. Moreover, when updating the router-table, it does not need to reconstruct the table. As a by-product, the proposed data structure minimizes the time required for dynamic router-table operations, including lookup, insertion, and deletion, and also reduces the number of memory accesses. We report the results of experiments conducted to compare the proposed data structure with other structures using the benchmark IPv4 prefix database AS4637 with 219,581 prefixes.

Preparing network configurations for IPv6 renumbering

AbstractThe difficulty of renumbering a network—i.e., adding and removing an Internet Protocol (IP) prefix due to a provider change or a network merger—is a real issue for most network administrators. In this paper, we propose a set of macros that can be used in configuration files. These allow network administrators to write generic configurations that are independent of the public IPv6 prefixes allocated to their network. We explain how to apply our macros to key configuration files, namely firewall access lists, Domain Name Service and Dynamic Host Configuration Protocol, and how to use this mechanism in a full renumbering process. Copyright © 2009 John Wiley & Sons, Ltd.

MPFS: A truly scalable router architecture for next generation Internet

A new generation architecture of IP routers called massive parallel forwarding and switching (MPFS) is proposed, which is totally different from modern routers. The basic idea of MPFS is mapping complicated forwarding process into multilevel scalable switch fabric so as to implement packet forwarding in a pipelining and distributed way. This processing mechanism is named forwarding in switching (FIS). By interconnecting multi-stage, lower speed components, called forwarding and switching nodes (FSN), MPFS achieves better scalability in forwarding and switching performance just like MPP. We put emphasis upon IPv6 lookup problem in MPFS and propose a method for partitioning IPv6 FIB and mapping them to switch fabric. Simulation and computation results suggest that MPFS routers can support line-speed forwarding with a million of IPv6 prefixes at 40 Gbps. We also propose an implementation of 160 Tbps core router based on MPFS architecture at last.

A nonredundant ternary CAM circuit for network search engines

An optimized Ternary CAM concept is introduced for the hardware search engines in high-speed Internet routers. Our design employs w + 1 RAM bits to store a word of size w, whereas a conventional TCAM needs 2w RAM bits for the same word size. Based on this concept an 8-bit cluster is designed out of 9 SRAM bits, used as the basic building block of our Prefix-CAM (PCAM) structure. Four such clusters merge to store a 32-bit IPv4 prefix, thus, configuring a PCAM suitable for Internet packet forwarding. This PCAM module employs 48% less SRAM cells and a total of 22% less transistors plus 50% less address decode interconnects compared to a conventional TCAM, for equal storage size and equal functionality. We show that PCAM can be employed for multifield packet classification. Other factors, such as lookup speed and power dissipation, are not adversely affected.

Reduce chord routing latency issue in the context of IPv6

Due to the mismatch between an overlay and its underlying physical network, the routing latency in existing DHT systems such as Chord and CAN is rather high. We note the fact that the IPv6 address hierarchical structure can aggregate route entries in Internet, and thus propose that nodes in an overlay can cluster together by taking advantage of the shared IPv6 prefix of specific length. While utilizing DHT systems themselves to store and retrieve the IPv6 prefix information, we adapt it to Chord and thus construct an improved version dubbed eChord. Analysis and simulation results confirm that eChord can significantly reduce routing latency.

Leveraging network performance with IPv6 multihoming and multiple provider-dependent aggregatable prefixes

Multihoming, the practice of connecting to multiple providers, is becoming highly popular. Due to the growth of the BGP routing tables in the Internet, IPv6 multihoming is required to preserve the scalability of the interdomain routing system. A proposed method is to assign multiple provider-dependent aggregatable (PA) IPv6 prefixes to each site, instead of a single provider-independent (PI) prefix. We show that the use of multiple PA prefixes not only allows route aggregation but also can be used to reduce end-to-end delays by leveraging the Internet path diversity. We quantify the gain in path diversity, and show that a dual-homed stub AS that uses multiple PA prefixes has already a better Internet path diversity than any multihomed stub AS that uses a single PI prefix, whatever its number of providers. The benefits provided by the use of IPv6 multihoming with multiple PA prefixes are an opportunity to develop the support for quality of service and traffic engineering.

An On-Chip IP Address Lookup Algorithm

This paper proposes a new data compression algorithm to store the routing table in a tree structure using very little memory. This data structure is tailored to a hardware design reference model presented in this paper. By exploiting the low memory access latency and high bandwidth of on-chip memory, high-speed packet forwarding can be achieved using this data structure. With the addition of pipeline in the hardware, IP address lookup can only be limited by the memory access speed. The algorithm is also flexible for different implementation. Experimental analysis shows that, given the memory width of 144 bits, our algorithm needs only 400kb memory for storing a 20k entries IPv4 routing table and five memory accesses for a search. For a 1M entries IPv4 routing table, 9Mb memory and seven memory accesses are needed. With memory width of 1,068 bits, we estimate that we need 100Mb memory and six memory accesses for a routing table with 1M IPv6 prefixes.

No Administration Protocol (NAP) for IPv6 router auto-configuration

This paper outlines the concept of auto-organisation in IPv6 networks. If the auto-configuration of hosts is defined by IPv6 and mandatory, these mechanisms can not be assimilated to a fully plug and play feature, as IPv6 routers still have to be manually configured. To succeed in new domains such as SOHO, a full auto-configuration feature must be offered. Indeed, the configuration of 64 bits IPv6 prefixes and the numbering of links is not really friendly and is error prone, especially in home networking. This paper tackles the issues that arise, reviews actual solutions, and proposes a totally distributed protocol named NAP for IPv6 routers auto-configuration.

IPv6-in-IPv4 Tunnel Discovery: Methods and Experimental Results

Tunnels are widely used to improve security and to expand networks without having to deploy native infrastructure. They play an important role in the migration to IPv6, which relies on IPv6-in-IPv4 tunnels where native connectivity is not available. However, tunnels offer lower performance and are less than native links. In this paper we introduce a number of techniques to detect, and collect information about, IPv6-in-IPv4 tunnels, and show how a known tunnel can be used as a "vantage point" to launch third-party tunnel-discovery explorations, scaling up the discovery process. We describe our Tunneltrace tool, which implements the proposed techniques, and validate them by means of a wide experimentation on the 6bone tunneled network, on native networks in Italy, the Netherlands, and Japan, and through the test boxes deployed worldwide by the RIPE NCC as part of the Test Traffic Measurements Service. We assess to what extent 6bone registry information is coherent with the actual network topology, and we provide the first experimental results on the current distribution of IPv6-in-IPv4 tunnels in the Internet, showing that even "native" networks reach more than 60 percent of all IPv6 prefixes through tunnels. Furthermore, we provide historical data on the migration to native IPv6, showing that the impact of tunnels in the IPv6 Internet did not significantly decrease over a six-month period. Finally, we briefly touch on the security issues posed by IPv6-in-IPv4 tunnels, discussing possible threats and countermeasures.