Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Sibling Prefixes: Identifying Similarities in IPv4 and IPv6 Prefixes

Fariba Osali, Khwaja Zubair Sediqi, Oliver Gasser

TL;DR

This work defines 'sibling prefixes' as IPv4-IPv6 prefix pairs with shared domain services and presents a DNS-driven method to identify them at scale. It introduces SP-Tuner, an algorithm that refines prefix CIDR sizes to maximize domain-based similarity (Jaccard) and achieves a substantial increase in perfect-match prefix pairs from 52% to 82%. Across ~76k sibling-prefix pairs, more than half originate from the same organization, with many prefixes showing stability over four years and notable presence in hypergiants and CDNs; over 60% have at least one valid ROV in RPKI. The study demonstrates the practical utility of sibling prefixes for dual-stack deployment analysis and policy applications, and it provides publicly available data and tools for researchers and operators.

Abstract

Since the standardization of IPv6 in 1998, both versions of the Internet Protocol have coexisted in the Internet. Clients usually run algorithms such as Happy Eyeballs, to decide whether to connect to an IPv4 or IPv6 endpoint for dual-stack domains. To identify whether two addresses belong to the same device or service, researchers have proposed different forms of alias resolution techniques. Similarly, one can also form siblings of IPv4 and IPv6 addresses belonging to the same device. Traditionally, all of these approaches have focused on individual IP addresses. In this work, we propose the concept of "sibling prefixes", where we extend the definition of an IPv4-IPv6 sibling to two IP prefixe-one IPv4 prefix and its sibling IPv6 prefix. We present a technique based on large-scale DNS resolution data to identify 76k IPv4-IPv6 sibling prefixes. We find sibling prefixes to be relatively stable over time. We present SP-Tuner algorithm to tune the CIDR size of sibling prefixes and improve the perfect match siblings from 52% to 82%. For more than half of sibling prefixes, the organization names for their IPv4 and IPv6 origin ASes are identical, and 60% of all sibling prefixes have at least one of the prefixes with a valid ROV status in RPKI. Furthermore, we identify sibling prefixes in 24 hypergiant and CDN networks. Finally, we plan to regularly publish a list of sibling prefixes to be used by network operators and fellow researchers in dual-stack studies.

Sibling Prefixes: Identifying Similarities in IPv4 and IPv6 Prefixes

TL;DR

This work defines 'sibling prefixes' as IPv4-IPv6 prefix pairs with shared domain services and presents a DNS-driven method to identify them at scale. It introduces SP-Tuner, an algorithm that refines prefix CIDR sizes to maximize domain-based similarity (Jaccard) and achieves a substantial increase in perfect-match prefix pairs from 52% to 82%. Across ~76k sibling-prefix pairs, more than half originate from the same organization, with many prefixes showing stability over four years and notable presence in hypergiants and CDNs; over 60% have at least one valid ROV in RPKI. The study demonstrates the practical utility of sibling prefixes for dual-stack deployment analysis and policy applications, and it provides publicly available data and tools for researchers and operators.

Abstract

Since the standardization of IPv6 in 1998, both versions of the Internet Protocol have coexisted in the Internet. Clients usually run algorithms such as Happy Eyeballs, to decide whether to connect to an IPv4 or IPv6 endpoint for dual-stack domains. To identify whether two addresses belong to the same device or service, researchers have proposed different forms of alias resolution techniques. Similarly, one can also form siblings of IPv4 and IPv6 addresses belonging to the same device. Traditionally, all of these approaches have focused on individual IP addresses. In this work, we propose the concept of "sibling prefixes", where we extend the definition of an IPv4-IPv6 sibling to two IP prefixe-one IPv4 prefix and its sibling IPv6 prefix. We present a technique based on large-scale DNS resolution data to identify 76k IPv4-IPv6 sibling prefixes. We find sibling prefixes to be relatively stable over time. We present SP-Tuner algorithm to tune the CIDR size of sibling prefixes and improve the perfect match siblings from 52% to 82%. For more than half of sibling prefixes, the organization names for their IPv4 and IPv6 origin ASes are identical, and 60% of all sibling prefixes have at least one of the prefixes with a valid ROV status in RPKI. Furthermore, we identify sibling prefixes in 24 hypergiant and CDN networks. Finally, we plan to regularly publish a list of sibling prefixes to be used by network operators and fellow researchers in dual-stack studies.

Paper Structure

This paper contains 40 sections, 3 equations, 38 figures, 2 algorithms.

Table of Contents

  1. Introduction
  2. Datasets
  3. DNS Dataset
  4. IP to Prefix and AS Dataset
  5. AS to Organization Mapping Datasets
  6. Hypergiants and CDN Datasets
  7. ASdb Datasets
  8. RPKI Dataset
  9. Port Scan Dataset
  10. Methodology
  11. Identifying Sibling Prefixes
  12. Examining Possible Similarity Metrics
  13. Sibling Prefix Tuner (SP-Tuner) Algorithm
  14. Effectiveness of SP-Tuner
  15. Ground Truth Evaluation
  16. ...and 25 more sections

Figures (38)

  • Figure 1: Number of all domains (left) and dual-stack (DS) domains (right) over time in the OpenINTEL dataset.
  • Figure 2: Comparison of Jaccard, Dice, and overlap coefficient similarity metrics.
  • Figure 3: Methodology to identify sibling prefixes using Jaccard similarity index.
  • Figure 4: Heatmap of SP-Tuner Algorithm Performance: Mean Jaccard Index (top) and Standard Deviation (bottom) across IPv4 (x-axis) and IPv6 (y-axis) CIDR size thresholds.
  • Figure 5: CDF of Jaccard similarity for sibling prefixes comparing default values with SP-Tuner algorithm at routable and optimal IPv4/IPv6 thresholds.
  • ...and 33 more figures