Based in Dresden, Germany
Articles
Likes on articles
I am a PhD student and research associate at the Chair of Distributed and Networked Systems at TU Dresden, supervised by Prof. Dr. Matthias Wählisch. Before joining TU Dresden, I graduated with a BSc and MSc in Computer Science from Freie Universität Berlin. My research focuses on Internet measurements to improve network security. I'm particularly interested in DNS and scalable IPv6 scanning.
• 9 min read
Brute-force IPv6 scanning doesn't scale, and ICMPv6 rate limiting can undermine topology measurements. Maynard Koch and colleagues show how Subnet-Router Anycast (SRA) probing discovers more router addresses, delivers more stable results, and expands the IPv6 measurement toolbox.
• 5 min read
Routing loops can trap packets between routers, preventing them from reaching their destination. In some cases, routers even duplicate looping packets, amplifying traffic and threatening Internet stability. We look at how this happens and how operators can prevent it.
• 10 min read
DNS infrastructure is infamous for facilitating reflective amplification attacks. Countermeasures such as server shielding, access control, rate limiting and protocol restrictions have improved the situation, but DNS-based reflective amplification attacks persist. Focusing on the threat vector intr…
Showing 3 article(s)
“"They represent the subnet, in that the host part of the IPv6 address is set to 0" It is not always a router. What about servers using this all-zero addresses, such as the public DNS resolvers at 2a09:: and 2a11::?”
We only accept responses where the sender's address differs from the originally requested IPv6 address. How do we know which IPv6 address we requested? We encode it in the ICMP payload, which is then reflected in the response… a neat feature of ICMP :) So, in your example, we would discard any response coming from 2a09:: or 2a11::. However, if a router has configured the all-zero address as its primary address, we would actually miss that router. We consider this limitation a reasonable trade-off, though, since it also eliminates the need to deal with aliased networks that respond to every address.
Showing 1 comment(s)