IPv6 address fast scanning method and system based on cross-kernel asynchronous transceiving

Abstract

The application relates to the technical field of Internet, in particular to an IPv6 address fast scanning method and system based on cross-kernel asynchronous transmission and reception, related configuration information required by a scanning task is acquired according to user input, and a detection data packet is constructed according to the related configuration information; the detection data packet is directly sent from a user state to a network card device by bypassing a kernel space, and a response data packet transmitted from the network card device to the user state is received; the response data packet is analyzed and a surviving IPv6 address is acquired. The application bypasses a Linux kernel protocol stack in IPv6 address fast scanning based on cross-kernel asynchronous transmission and reception, directly carries out asynchronous transmission and reception of data packets between a user space and a network card, and realizes the requirement of IPv6 address fast detection.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and in particular to a method and system for fast scanning of IPv6 addresses based on cross-kernel asynchronous transmission and reception. Background Technology

[0002] In recent years, with more and more networks and terminal hosts supporting IPv6 networks, the IPv6 landscape has undergone tremendous changes. To achieve the goal of IPv6 network address scanning, IPv6 address scanning technology has gradually developed. Since IPv4 addresses are only 32 bits long, scanning them is very easy. However, IPv6 addresses are 128 bits long, four times longer than IPv4 addresses, making address scanning exponentially more difficult and rendering traversal scanning methods from the IPv4 approach impossible. To effectively reduce the IPv6 address search space, the mainstream approach to IPv6 address scanning currently focuses on address prediction and target address generation based on seed addresses. By mining the inherent patterns of allocated IPv6 addresses, mathematical methods such as machine learning algorithms, deep learning models, and graph theory are used to generate a set of potentially viable IPv6 predicted addresses. The number of addresses in this set is significantly reduced compared to the entire IPv6 address space, thus effectively reducing the IPv6 address detection space and greatly improving the efficiency of finding viable IPv6 addresses. However, existing IPv6 target address generation algorithms suffer from low prediction accuracy and high missed scan rates.

[0003] After successfully generating the IPv6 predicted address set, these IPv6 addresses need to be verified for liveness. Currently, the only mainstream liveness verification technology is Zmapv6. Besides Masscan, Xmap, and Scan6, which are three other IPv6 traversal address scanning technologies, Zmapv6 is also one of them. The vast address space of IPv6 networks makes exhaustive probing impossible. For example, on a 10 Gigabit network, scanning all IPv6 addresses within the 64-bit prefix range using Zmapv6 would take at least millions of years, which is clearly unacceptable. Furthermore, these scanning technologies are all implemented in kernel mode; without improving network card performance and network link bandwidth, it is difficult to significantly increase the speed of sending and receiving probe packets. These factors are the main obstacles to improving the speed of IPv6 network scanning.

[0004] This paper analyzes four existing IPv6 address scanning technologies—Masscan, Scan6, Zmapv6, and Xmap—from the perspectives of their supported scanning methods and packet transmission / reception methods. All four tools are application-level improvements, relying on traditional kernel-based packet processing for packet transmission and reception. When processing the large-scale packets generated by IPv6 address scanning, traditional kernel-based packet processing uses interrupts to distribute packets to the kernel, leading to frequent interrupts and performance overhead. Furthermore, after the kernel processes the packets, it needs to copy them to the user layer, which also negatively impacts performance. Therefore, these issues pose significant challenges in handling the large-scale packets generated by IPv6 address scanning. Summary of the Invention

[0005] To address this issue, the present invention provides a fast IPv6 address scanning method and system based on cross-kernel asynchronous transmission and reception, which solves the problem of slow IPv6 address scanning speed and realizes the requirement for fast IPv6 address detection.

[0006] According to the design scheme provided by this invention, a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception is provided, comprising:

[0007] Obtain the relevant configuration information required for the scanning task based on user input, and construct probe data packets based on the relevant configuration information;

[0008] Bypassing the kernel space, probe packets are sent directly from user space to the network interface card (NIC) device, and response packets are received from the NIC device to user space.

[0009] Parse the response packet and obtain the live IPv6 addresses.

[0010] As a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception of the present invention, further, the relevant configuration information required for the scanning task is obtained according to user input, and a probe packet is constructed according to the relevant configuration information, including:

[0011] First, based on user input, determine the probe type, destination IPv6 address, and port required for the scanning task, and obtain the MAC address of the default gateway through the Neighbor Discovery Protocol (NDP).

[0012] Then, the IPv6 address and MAC address of the scanning host are used as the source address information, and the target IPv6 address and the MAC address of the default gateway are used as the target address information. Based on the probe type, corresponding probe packets are generated.

[0013] As a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception in this invention, when generating corresponding probe packets according to the probe type, if the probe type is ICMPv6, an ICMPv6 echo request probe packet is constructed; if the probe type is TCP, a TCP_SYN probe packet is constructed; and if the probe type is UDP, a UDP probe packet is constructed.

[0014] As a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception in this invention, it further bypasses the kernel space to send probe packets directly from user space to the network card device, and receives response packets transmitted from the network card device to user space. This includes: using the Data Plane Development Kit (DPDK), user space I / O, and polling mode to drive direct interaction of data packets between user space and network card device through an independent thread.

[0015] As a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception in this invention, it further includes: direct data packet exchange between user space and network interface card (NIC) via an independent thread, comprising:

[0016] First, for probe packets, the environment abstraction layer and network card device driver are initialized by calling DPDK library functions, and the network card device parameters are set, including MTU, MAC address and IP address;

[0017] Then, a memory pool is created, memory is allocated for each response packet, and the response packets are directly put into the sending queue using the interface functions of the DPDK library, waiting for the network card to send them.

[0018] As a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception of the present invention, further, parsing the response data packet and obtaining the live IPv6 address also includes: verifying whether the response data packet belongs to the current scanning task based on the parsing result.

[0019] As a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception of the present invention, further, verifying whether the response data packet belongs to the current scanning task based on the parsing result includes: extracting the next header field information of the response data packet, determining the response data packet type based on the field information, and if the response data packet type is UDP or TCP, then verifying whether the response and probe data packet lengths are the same and whether the source port and probe destination port are consistent, and if the response data packet type is ICMPv6 echo request, then verifying whether the response and probe data packet lengths are the same, and determining whether the response data packet belongs to the response triggered by the current scanning task based on the verification result.

[0020] Furthermore, the present invention also provides a fast IPv6 address scanning system based on cross-kernel asynchronous transmission and reception, comprising: a probe packet construction module, a probe packet transmission and reception module, and a response packet parsing module, wherein,

[0021] The probe packet construction module is used to obtain the relevant configuration information required for the scanning task based on user input, and to construct probe data packets based on the relevant configuration information;

[0022] The probe packet transceiver module is used to bypass the kernel space to send probe packets directly from user space to the network interface card (NIC) device, and to receive response packets transmitted from the NIC device to user space.

[0023] The response packet parsing module is used to parse response packets and obtain live IPv6 addresses.

[0024] The beneficial effects of this invention are:

[0025] This invention addresses the slow scanning speed of existing IPv6 address scanning methods. It bypasses the Linux kernel protocol stack in a fast IPv6 address scan based on cross-kernel asynchronous transmission and reception, directly enabling asynchronous packet transmission and reception between user space and the network interface card (NIC). Furthermore, it provides a dedicated tool for fast IPv6 address scanning, DScan6, which collects 26.9 million IPv6 addresses from five data sources, including Rapid7 and Hitlist, as a target address set. This set includes clients, routers, and servers, and a randomly selected target address range with a / 64 prefix. Experiments comparing the packet transmission and reception rates of DScan6 with four existing scanning tools—Masscan, Scan6, XMap, and Zmapv6—show that DScan6 achieves 99.3% of the theoretical maximum speed of a gigabit Ethernet link, making it 2.1 to 3.4 times faster than existing scanning tools. Additionally, DScan6 also obtains 373.7k live IPv6 addresses, which can be further analyzed to obtain the country of origin, national internet service provider, interface identifier type, and NIC manufacturer, facilitating applications in precise network governance, network situational analysis, and network security management. Attached image description:

[0026] Figure 1 This is a schematic diagram of the fast IPv6 address scanning process based on cross-kernel asynchronous transmission and reception in the embodiment.

[0027] Figure 2 This is a schematic diagram of the synchronous and asynchronous transmission and reception process in the embodiment;

[0028] Figure 3 This is a schematic diagram of the probe packet construction process in the embodiment;

[0029] Figure 4 This is a schematic diagram of the response packet verification process in the embodiment;

[0030] Figure 5 This is a schematic diagram of the DScan6 scanning tool architecture in the embodiment;

[0031] Figure 6 This is a schematic diagram of the data packet transmission and reception architecture in the example. Detailed implementation method:

[0032] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0033] Network asset discovery is a crucial support for precise network governance, network situational analysis, and network security management. As a globally recognized next-generation internet solution, IPv6 has achieved a global deployment rate exceeding 35%, and my country's IPv6 network is transitioning from "accessible paths" to "operational networks." Existing network asset discovery technologies can scan the entire 32-bit IPv4 address space within 6 minutes. However, due to the characteristics of IPv6 addresses—vast space, sparse distribution, multiple addresses per point, and address volatility—current traversal address scanning methods are slow and cannot meet the demands for rapid IPv6 address detection. Therefore, in this embodiment of the invention, see... Figure 1 As shown, a fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception is provided, including:

[0034] S101. Obtain the relevant configuration information required for the scanning task based on the user input, and construct the probe data packet based on the relevant configuration information.

[0035] S102. Bypass the kernel space to send probe packets directly from user space to the network card device, and receive response packets transmitted from the network card device to user space.

[0036] S103. Parse the response data packet and obtain the live IPv6 address.

[0037] The liveness verification techniques used in the existing IPv6 predicted address set are summarized and analyzed, as shown in Table 1.

[0038] Table 1 Summary of Existing Prediction Algorithms and IPv6 Predicted Address Liveness Verification Technologies

[0039]

[0040] Currently, the only mainstream liveness verification technology is Zmapv6, and the scanning method it uses is mainly ICMPv6 echo request. Table 2 analyzes the four existing IPv6 address scanning technologies—Masscan, Scan6, Zmapv6, and Xmap—from the perspectives of supported scanning methods and packet transmission / reception methods.

[0041] Table 2 Summary of Existing Scanning Tools

[0042]

[0043]

[0044] √: indicates that this type is supported; ×: indicates that this type is not supported.

[0045] Only Xmap and Zmapv6 support the three main scanning methods: ICMPv6 echo request scan, TCP_SYN scan, and UDP scan. Other tools (such as Masscan) only support TCP_SYN scan and UDP scan, while Scan6 only supports ICMPv6 echo request scan. The ICMPv6 echo request and TCP_SYN scan packets constructed using these methods are identical. However, Masscan, Xmap, and Zmapv6, which provide UDP scan methods, generate UDP probe packets of different sizes due to the different content of the UDP message fields they send.

[0046] Synchronous transmission and reception refers to the synchronization of the sender's and receiver's clocks during data transmission to ensure the accuracy and integrity of the data. In synchronous transmission, the sender waits for a response from the receiver after sending data; only after the receiver confirms receipt will the sender continue sending the next data message. Asynchronous transmission and reception, on the other hand, involves the sender immediately sending the next data message after sending data, without waiting for a response from the receiver. The receiver processes the received data automatically without sending any acknowledgment messages. Figure 2 As shown, compared to synchronous methods, asynchronous transmission and reception can achieve higher data transmission throughput and is more flexible. Except for Scan6, which uses synchronous packet transmission and reception, the other three technologies all employ the more efficient asynchronous transmission and reception method.

[0047] To achieve faster IPv6 address scanning, a comparative analysis is conducted on high-performance network packet processing frameworks currently proposed to handle large-scale packet processing needs. The Data Plane Development Kit (DPDK), as one such high-performance network packet processing framework, adopts a fully user-space driven architecture, abandons kernel interrupts, and provides an efficient memory management mechanism. It uses Direct Memory Access (DMA) to transfer packets to user space for processing, thereby reducing the number of copies and context switches. Furthermore, commonly used high-performance network packet processing frameworks on the market, such as Netmap, Snap, and PF_RING, also have similar technical characteristics to DPDK. A comparison of their technical features is shown in Table 3.

[0048] Table 3. Feature Comparison of High-Performance Network Packet Processing Frameworks Based on Cross-Kernel

[0049]

[0050]

[0051] √: Indicates support for the technology; ×: Indicates lack of support for the technology.

[0052] By comparing and analyzing the above four mainstream high-performance network packet processing frameworks, it can be seen that the DPDK framework can achieve true zero-copy full user-space data processing. Therefore, in this embodiment, it is possible to consider using DPDK to achieve fast IPv6 address scanning with asynchronous cross-kernel transmission and reception. By using the DPDK data plane development kit, user-space I / O and polling mode to bypass the kernel space, packet interaction can be performed directly between user space and network interface card devices through an independent thread.

[0053] In a preferred embodiment, further, obtaining the relevant configuration information required for the scanning task based on user input, and constructing a probe packet based on the relevant configuration information, can be designed to include the following steps:

[0054] First, based on user input, determine the probe type, destination IPv6 address, and port required for the scanning task, and obtain the MAC address of the default gateway through the Neighbor Discovery Protocol (NDP).

[0055] Then, the IPv6 address and MAC address of the scanning host are used as the source address information, and the target IPv6 address and the MAC address of the default gateway are used as the target address information. Based on the probe type, corresponding probe packets are generated.

[0056] Specifically, when generating the corresponding probe data packet according to the probe type, if the probe type is ICMPv6, an ICMPv6 echo request probe packet is constructed; if the probe type is TCP, a TCP_SYN probe packet is constructed; and if the probe type is UDP, a UDP probe packet is constructed.

[0057] See Figure 3 As shown, this document demonstrates the construction of probe packets for three mainstream address scanning methods: ICMPv6 echo request, TCP_SYN, and UDP scanning. During probe packet construction, the values ​​of fields such as the probe type, destination IPv6 address, and port are determined based on user input. Additionally, the MAC address of the default gateway is obtained via the Neighbor Discovery Protocol (NDP). The IPv6 address and MAC address of the host being scanned are used as the source address information, and the destination IPv6 address and the MAC address of the default gateway are used as the target information. The corresponding probe data packet is then generated according to the probe type specified by the user.

[0058] Furthermore, by using an independent thread to directly interact with data packets between user space and the network interface card (NIC), for probe data packets, the environment abstraction layer and NIC device driver are initialized by calling DPDK library functions, and NIC device parameters, including MTU, MAC address, and IP address, are set. A memory pool is created, and memory is allocated for each response data packet. Then, the response data packets are directly placed into the sending queue using DPDK library interface functions, waiting for the NIC to send them.

[0059] The DPDK technology is used to send data directly from user space to the network interface card (NIC) hardware, and the response data packet is then directly transmitted from the NIC to the user-layer DPDK application for further parsing. The specific implementation process is shown in Table 4.

[0060] Table 4. Details of probe packet sending and receiving functions

[0061]

[0062]

[0063] When parsing the response packet and obtaining the live IPv6 addresses, the system verifies whether the response packet belongs to the current scan task based on the parsing result. See also Figure 4 As shown, specifically: extract the next header field information of the response data packet, determine the type of the response data packet based on the field information. If the response data packet type is UDP or TCP, then verify in turn whether the length of the response and probe data packets are the same, and whether the source port and probe destination port are consistent. If the response data packet type is ICMPv6 echo request, then verify whether the length of the response and probe data packets are the same, and determine whether the response data packet belongs to the response triggered by the current scan task based on the verification result.

[0064] The main purpose of response packet verification is to determine whether the data traffic packets received from the network card belong to the scope of the current scan task, to prevent false reports of spurious response packets caused by background traffic, and responses caused by previous scans.

[0065] Furthermore, based on the above method, this embodiment of the invention also provides a fast IPv6 address scanning system based on cross-kernel asynchronous transmission and reception, comprising: a probe packet construction module, a probe packet transmission and reception module, and a response packet parsing module, wherein,

[0066] The probe packet construction module is used to obtain the relevant configuration information required for the scanning task based on user input, and to construct probe data packets based on the relevant configuration information;

[0067] The probe packet transceiver module is used to bypass the kernel space to send probe packets directly from user space to the network interface card (NIC) device, and to receive response packets transmitted from the NIC device to user space.

[0068] The response packet parsing module is used to parse response packets and obtain live IPv6 addresses.

[0069] The system parses the parameters entered by the user via the command line to obtain the relevant configuration information required for the scanning task, such as the target address range or file, and the scan type. Then, it constructs probe packets for the corresponding address scanning method according to the address scan type and address range specified by the user. Next, it uses the Data Plane Development Kit (DPDK) technology to quickly send and receive probe packets. Finally, it parses the live IPv6 addresses from the received response packets.

[0070] Based on the feasibility analysis of the solution, this embodiment also provides a specific implementation tool, DScan6, see [link to implementation details]. Figure 5 As shown, it is divided into three main modules: probe packet generation strategy, cross-kernel asynchronous transmission timing, and cross-kernel-based asynchronous reception and verification of response packets. The probe packet generation strategy module mainly constructs probe packets based on the input IPv6 address and port. The cross-kernel-based asynchronous probe packet transmission module copies the probe packets directly from user space to the network card device in an asynchronous manner. The cross-kernel-based asynchronous reception and verification of response packets is responsible for copying the response packets directly from the network card to user space in an asynchronous manner, thereby completing the verification of whether the packets are valid response packets.

[0071] The probe packet generation module is responsible for building the IPv6 user-space protocol stack and generating Ethernet data frames. Based on the analysis of the scanning methods supported by existing IPv6 address scanning tools, this module uses three mainstream scanning methods: ICMPv6 echo request scan, TCP_SYN scan, and UDP scan.

[0072] The probe type, destination IPv6 address, and default gateway MAC address are obtained by parsing the input. The MAC and IPv6 addresses of the sending host, along with randomly generated port information, are used as source information. Based on this information, corresponding probe packets are generated, as shown in Algorithm 1 in Table 5.

[0073] Table 5. Address Liveness Detection Packet Generation Algorithm

[0074]

[0075] DScan6 uses DPDK technology to bypass the Linux kernel, leveraging user-space I / O (UIO) and pool-mode driver (PMD) technologies to enable direct data packet exchange between the network card and user-space applications without interrupting the central processing unit (CPU). This allows for data packet sending and receiving processing in user space, thus enabling fast IPv6 address scanning. Figure 6 As shown.

[0076] DScan6 sends and receives data packets on independent threads. These threads operate independently and continuously throughout the scan, ensuring that the receiver is initialized before sending probes. The packet sending module is responsible for initializing DPDK and transmitting the probe packets generated by Algorithm 1 directly to the network card through DPDK's packet sending interface, as shown in Algorithm 2 in Table 6.

[0077] Table 6. Algorithm for Asynchronous Sending of Cross-Kernel Probe Messages

[0078]

[0079]

[0080] After the transmitter completes its transmission task, the receiver continues to run for a period of time (5 seconds) to process any delayed responses. The packet reception and verification module needs to verify the packet length, probe type, source port, and destination port to determine whether the received packet is a valid response to probes from the target or other background traffic, as shown in Algorithm 3 in Table 7. These low-cost checks prevent erroneous reports of false response packets due to background traffic, as well as responses triggered by previous scans.

[0081] Table 7. Algorithm for Asynchronous Reception and Validity Verification of Cross-Kernel Response Messages

[0082]

[0083] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0084] IPv6 addresses were collected from multiple public data sources such as Rapid7 and Hitlist as the target address set, and a / 64 prefix was randomly selected as the target address range. The packet transmission and reception speeds of DScan6 were compared with those of Masscan, Scan6, XMap, and Zmapv6. Based on the live IPv6 addresses scanned during the test, further security-related analyses were performed on these live addresses, including IPv6 address type, country of origin, and internet service provider.

[0085] 1. Target address collection

[0086] Table 8. Overview of Target IPv6 Addresses

[0087]

[0088] Over the course of nearly a month, a total of more than 26.9 million IPv6 addresses were collected from multiple publicly available sources, all of which are freely accessible to anyone. To achieve a balanced use of resources, these sources were allocated to servers, routers, and a small number of clients. The data sources used are summarized in Table 8:

[0089] (1) Rapid7: This dataset contains DNS request responses for all forward DNS names (FDNS) known to Rapid7’s Sonar project, and a total of 15 million IPv6 addresses were collected through this dataset.

[0090] (2) Bitnodes: This dataset collects all reachable nodes in the Bitcoin peer-to-peer network by using the Bitnodes Application Programming Interface (API). A total of 33,000 client IPv6 addresses were collected through this dataset.

[0091] (3) RIPE Atlas: A total of 95,000 router IPv6 addresses were collected by extracting all IPv6 addresses found in RIPE Atlas traceroutes and all IPv6 addresses in RIPE's ipmap project.

[0092] (4) I8: Composed of IPv6 addresses collected from the Alexa country list, daily DNS AAAA resolutions of various Zonefiles (such as .com, .net, .org and other various files), and the DNS name dataset of CAIDA (Cooperative Association for Internet Data Analysis), a total of 0.2M server IPv6 addresses were collected through this dataset.

[0093] (5) Hitlist: This dataset collects IPv6 addresses from multiple sources, including DNS AAAA resolution, traceroutes, and Certificate Transparency (CT) logs. Furthermore, its inputs are regularly updated and the responsiveness of the addresses is tested. A total of 11.6 million IPv6 addresses were collected through this dataset.

[0094] 2. Address scanning behavior constraints

[0095] The impact of scanning within the high-speed internet range on source and target networks was considered. Throughout the study, network measurement research practices were followed, including best practices and broad guidelines, and a series of measures were taken to minimize potential impact. A simple webpage was created on the source IPv6 address to demonstrate the benign intent of the network scan and display the scan initiator's contact information, such as an email address, so that hosts on the target network segment could remove themselves from the target address after indicating their unwillingness to be scanned. Secondly, the order of target addresses was randomly shuffled to avoid overwhelming the target network with sequential scans. Furthermore, multiple source addresses were used to evenly distribute scan traffic, reducing the risk of intrusion detection systems (IDS) misidentifying it as a denial-of-service (DoS) attack. Finally, user privacy was protected, and any data related to IPv6 network assets discovered during the experiment was never disclosed or illegally used.

[0096] 3. Comparative Analysis

[0097] By configuring the experimental environment shown in Table 9 on a gigabit Ethernet link, a comparative experiment was conducted on the packet transmission and reception speeds of DScan6 and the existing Masscan, Zmapv6, Scan6 and Xmap.

[0098] Table 9 Experimental Environment Information

[0099]

[0100] Since Masscan and Scan6 only support specifying address ranges as scan input, while Zmapv6 and Xmap only support specifying address set files as scan input, the experiment randomly selected an IPv6 address range with a / 64 prefix and compared DScan6 with Masscan and Scan6. Additionally, using the collected IPv6 address set as the target address set file, DScan6 was compared with Zmapv6 and Xmap.

[0101] In the experiment, the packet transmission and reception speeds of DScan6 were compared with those of these four tools under three mainstream scanning methods: ICMPv6 echo request scan, TCP_SYN scan, and UDP scan. Ten repeated experiments were conducted evenly over a 12-hour period, and the final average value was calculated. The experimental results are shown in Table 10.

[0102] Table 10: Comparison of Scanning Speeds

[0103]

[0104] pps: Number of packets per second; ×: indicates that this scanning method is not supported.

[0105] The results show that DScan6 achieved 99.3% of the theoretical maximum speed of Gigabit Ethernet. Using the ICMPv6 echo request scan method, DScan6 sent and received packets 2.6 to 3.4 times faster than other tools. Using the TCP_SYN scan method, DScan6 was 2.2 to 3.1 times faster than other tools. Using the UDP scan method, DScan6 was 2.1 to 3.1 times faster than other tools.

[0106] Furthermore, DScan6 obtained 37.2k live IPv6 addresses after scanning 26.9 million collected IPv6 addresses and IPv6 addresses within the specified / 64 address range. Further analysis of these live IPv6 addresses revealed their geographical location, interface identifier type distribution, and the implicit device vendor information.

[0107] (1) Geographical location analysis of IPv6 addresses

[0108] By querying the countries and Internet service providers (ISPs) to which the scanned surviving IPv6 addresses belong, the top 5 countries with the most surviving IPv6 addresses and the top 3 ISPs in these countries were obtained, as shown in Table 11.

[0109] Table 11. Country and ISP Distribution of IPv6 Addresses

[0110]

[0111] (2) IPv6 address interface identifier type analysis

[0112] The addr6 tool was used to analyze the number and proportion of various interface identifier types in all discovered IPv6 addresses, as shown in Table 12.

[0113] Table 12 Analysis of Interface Identifiers for IPv6 Addresses

[0114]

[0115] Of these, random addresses following security recommendations constitute the largest proportion (53.6%), which are typically generated by SLAAC for end-host devices in practice. This type of address is difficult to predict and scan, significantly reducing the risk of the end-host being discovered by attackers on the internet. Low-byte types are the most numerous in manually configured interface identifier methods, indicating that many servers still use this configuration method to generate their IPv6 addresses.

[0116] (3) Analysis of device manufacturers implied in EUI-64 type

[0117] EUI-64 type interface identifiers are typically obtained from a 48-bit hardware address, consisting of a 24-bit OUI specified by the IEEE and a 24-bit 0xfffe embedded by the manufacturer. Therefore, the MAC address's OUI can be extracted from the EUI-64 format address to identify the network interface card (NIC) manufacturer. Based on the 8300 EUI-64 type IPv6 addresses obtained, the top 7 device manufacturers were analyzed, as shown in Table 13.

[0118] Table 1.3 Distribution of Equipment Manufacturers

[0119]

[0120] The above experiments comparing the packet transmission and reception rates of DScan6 with four existing scanning tools—Masscan, Scan6, XMap, and Zmapv6—demonstrate that the DScan6 scanning tool in this solution can achieve 99.3% of the theoretical maximum speed of a gigabit Ethernet link, which is 2.1 to 3.4 times faster than existing scanning tools. Furthermore, DScan6 obtained 373.7k live IPv6 addresses, and further analysis revealed the countries to which these IPv6 addresses belong, their national internet service providers, interface identifier types, and network interface card (NIC) manufacturers. This demonstrates promising application prospects in network asset discovery.

[0121] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0122] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0123] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0124] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0125] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A fast IPv6 address scanning method based on cross-kernel asynchronous transmission and reception, characterized in that, Include: Obtain the relevant configuration information required for the scanning task based on user input, and construct probe data packets based on the relevant configuration information; Bypassing the kernel space, probe packets are sent directly from user space to the network interface card (NIC) device, and response packets are received from the NIC device to user space. Parse the response packet and obtain the live IPv6 address, and verify whether the response packet belongs to the current scan task based on the parsing result; This includes: extracting the next header field information of the response packet, determining the type of the response packet based on the field information, and verifying whether the response and probe packet lengths are the same and whether the source port and probe destination port are consistent if the response packet type is UDP or TCP. If the response packet type is ICMPv6 echo request, verifying whether the response and probe packet lengths are the same, and determining whether the response packet belongs to the response triggered by the current scan task based on the verification result.

2. The method for fast IPv6 address scanning based on cross-kernel asynchronous transmission and reception according to claim 1, characterized in that, Based on user input, obtain the relevant configuration information required for the scanning task, and construct a probe packet according to the relevant configuration information, including: First, the probe type, destination IPv6 address and port required for the scanning task are determined based on user input, and the MAC address of the default gateway is obtained through the Neighbor Discovery Protocol (NDP). Then, the IPv6 address and MAC address of the scanning host are used as the source address information, and the target IPv6 address and the MAC address of the default gateway are used as the target address information. Based on the probe type, corresponding probe packets are generated.

3. The method for fast IPv6 address scanning based on cross-kernel asynchronous transmission and reception according to claim 2, characterized in that, When generating the corresponding probe packet based on the probe type, if the probe type is ICMPv6, then an ICMPv6 probe packet is constructed; if the probe type is TCP, then a TCP_SYN probe packet is constructed; and if the probe type is UDP, then a UDP probe packet is constructed.

4. The method for fast IPv6 address scanning based on cross-kernel asynchronous transmission and reception according to claim 1, characterized in that, Bypassing the kernel space, probe packets are sent directly from user space to the network interface card (NIC) device, and response packets are received from the NIC device back to user space. This involves using the Data Plane Development Kit (DPDK), user space I / O, and polling mode drivers to directly exchange data packets between user space and the NIC device via an independent thread.

5. The method for fast IPv6 address scanning based on cross-kernel asynchronous transmission and reception according to claim 4, characterized in that, Data packets are exchanged directly between user space and the network interface card (NIC) via a separate thread, including: First, for probe packets, the environment abstraction layer and network card device driver are initialized by calling DPDK library functions, and the network card device parameters are set, including MTU, MAC address and IP address; Then, a memory pool is created to allocate memory for each response packet; and the response packets are directly placed into the sending queue using the interface functions of the DPDK library, waiting for the network card to send them.

6. A fast IPv6 address scanning system based on cross-kernel asynchronous transmission and reception, characterized in that, It includes: a probe packet construction module, a probe packet sending and receiving module, and a response packet parsing module. The probe packet construction module is used to obtain the relevant configuration information required for the scanning task based on user input, and to construct probe data packets based on the relevant configuration information; The probe packet transceiver module is used to bypass the kernel space to send probe packets directly from user space to the network interface card (NIC) device, and to receive response packets transmitted from the NIC device to user space. The response packet parsing module is used to parse response packets and obtain live IPv6 addresses, and verify whether the response packet belongs to the current scanning task based on the parsing results; This includes: extracting the next header field information of the response packet, determining the type of the response packet based on the field information, and verifying whether the response and probe packet lengths are the same and whether the source port and probe destination port are consistent if the response packet type is UDP or TCP. If the response packet type is ICMPv6 echo request, verifying whether the response and probe packet lengths are the same, and determining whether the response packet belongs to the response triggered by the current scan task based on the verification result.

7. An electronic device, characterized in that, The system includes a memory and a processor, which communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor can execute the steps of the method as described in any one of claims 1 to 5 by calling the program instructions.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1 to 5.

Images