Network fingerprinting: TTL-based router signatures

  • Authors:
  • Yves Vanaubel;Jean-Jacques Pansiot;Pascal Mérindol;Benoit Donnet

  • Affiliations:
  • Université de Liège, Liège, Belgium;Université de Strasbourg, Strasbourg, France;Université de Strasbourg, Strasbourg, France;Université de Liège, Liège, Belgium

  • Venue:
  • Proceedings of the 2013 conference on Internet measurement conference
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

Fingerprinting networking equipment has many potential applications and benefits in network management and security. More generally, it is useful for the understanding of network structures and their behaviors. In this paper, we describe a simple fingerprinting mechanism based on the initial TTL values used by routers to reply to various probing messages. We show that main classes obtained using this simple mechanism are meaningful to distinguish routers platforms. Besides, it comes at a very low additional cost compared to standard active topology discovery measurements. As a proof of concept, we apply our method to gain more insight on the behavior of MPLS routers and to, thus, more accurately quantify their visible/invisible deployment.