vrfinder: Finding outbound addresses in traceroute
Marder, A., Luckie, M. J., Huffaker, B., & claffy, kc. (2020). vrfinder: Finding outbound addresses in traceroute. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 4(2). https://doi.org/10.1145/3392158
Permanent Research Commons link: https://hdl.handle.net/10289/13661
Current methods to analyze the Internet's router-level topology with paths collected using traceroute assume that the source address for each router in the path is either an inbound or off-path address on each router. In this work, we show that outbound addresses are common in our Internet-wide traceroute dataset collected by CAIDA's Ark vantage points in January 2020, accounting for 1.7% - 5.8% of the addresses seen at some point before the end of a traceroute. This phenomenon can lead to mistakes in Internet topology analysis, such as inferring router ownership and identifying interdomain links. We hypothesize that the primary contributor to outbound addresses is Layer 3 Virtual Private Networks (L3VPNs), and propose vrfinder, a technique for identifying L3VPN outbound addresses in traceroute collections. We validate vrfinder against ground truth from two large research and education networks, demonstrating high precision (100.0%) and recall (82.1% - 95.3%). We also show the benefit of accounting for L3VPNs in traceroute analysis through extensions to bdrmapIT, increasing the accuracy of its router ownership inferences for L3VPN outbound addresses from 61.5% - 79.4% to 88.9% - 95.5%.
© 2020 Copyright held by the author(s). Publication rights licensed to ACM.