{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,5]],"date-time":"2026-02-05T05:16:42Z","timestamp":1770268602510,"version":"3.49.0"},"publisher-location":"Cham","reference-count":38,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031859595","type":"print"},{"value":"9783031859601","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-85960-1_2","type":"book-chapter","created":{"date-parts":[[2025,3,6]],"date-time":"2025-03-06T07:23:39Z","timestamp":1741245819000},"page":"30-43","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["A Closer Look at\u00a0IPv6 IP-ID Behavior in\u00a0the\u00a0Wild"],"prefix":"10.1007","author":[{"given":"Fengyuan","family":"Huang","sequence":"first","affiliation":[]},{"given":"Yifan","family":"Yang","sequence":"additional","affiliation":[]},{"given":"Zhenzhong","family":"Yang","sequence":"additional","affiliation":[]},{"given":"Bingnan","family":"Hou","sequence":"additional","affiliation":[]},{"given":"Yingwen","family":"Chen","sequence":"additional","affiliation":[]},{"given":"Zhiping","family":"Cai","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,3,7]]},"reference":[{"key":"2_CR1","unstructured":"Maxmind geolite2 free geolocation data (2024). https:\/\/dev.maxmind.com\/geoip\/geolite2-free-geolocation-data"},{"key":"2_CR2","doi-asserted-by":"crossref","unstructured":"Alexander, G., Espinoza, A.M., Crandall, J.R.: Detecting TCP\/IP connections via IPID hash collisions. Proc. Priv. Enhancing Technol. (2019)","DOI":"10.2478\/popets-2019-0071"},{"key":"2_CR3","doi-asserted-by":"crossref","unstructured":"Almquist, P.: RFC1349: type of service in the internet protocol suite (1992)","DOI":"10.17487\/rfc1349"},{"key":"2_CR4","unstructured":"Baker, F., Black, D.L., Nichols, K., Blake, S.L.: RFC 2474: definition of the differentiated services field (DS field) in the IPv4 and IPv6 headers (1998)"},{"key":"2_CR5","doi-asserted-by":"crossref","unstructured":"Bender, A., Sherwood, R., Spring, N.: Fixing ally\u2019s growing pains with velocity modeling. In: Proceedings of the ACM Internet measurement Conference (IMC), pp. 337\u2013342 (2008)","DOI":"10.1145\/1452520.1452560"},{"key":"2_CR6","doi-asserted-by":"crossref","unstructured":"Beverly, R., Brinkmeyer, W., Luckie, M., Rohrer, J.P.: IPv6 alias resolution via induced fragmentation. In: Proceedings of the Passive and Active Network Measurement (PAM), pp. 155\u2013165 (2013)","DOI":"10.1007\/978-3-642-36516-4_16"},{"key":"2_CR7","doi-asserted-by":"crossref","unstructured":"Beverly, R., Luckie, M., Mosley, L., Claffy, K.: Measuring and characterizing IPv6 router availability. In: Proceedings of the Passive and Active Network Measurement (PAM), pp. 123\u2013135 (2015)","DOI":"10.1007\/978-3-319-15509-8_10"},{"key":"2_CR8","unstructured":"Cai, Z., Hou, B., Su, J., Wu, K., Xiong, Y.: 6hit: a reinforcement learning-based approach to target generation for internet-wide ipv6 scanning. In: 40th IEEE Conference on Computer Communications (IEEE INFOCOM) (2021)"},{"key":"2_CR9","unstructured":"CAIDA: The IPv6 DNS names dataset (2024). https:\/\/www.caida.org\/catalog\/datasets\/ipv6_dnsnames_dataset\/"},{"key":"2_CR10","doi-asserted-by":"crossref","unstructured":"Chen, W., et al.: Exploiting the IPID field to infer network path and end-system characteristics. In: Proceedings of the Passive and Active Network Measurement (PAM), pp. 108\u2013120 (2005)","DOI":"10.1007\/978-3-540-31966-5_9"},{"key":"2_CR11","doi-asserted-by":"crossref","unstructured":"Conta, A., Deering, S.: RFC 4443: Internet control message protocol (ICMPv6) for the internet protocol version 6 (IPv6) specification (2006)","DOI":"10.17487\/rfc4443"},{"key":"2_CR12","doi-asserted-by":"crossref","unstructured":"Custura, A., Fairhurst, G., Learmonth, I.R.: Exploring usable path MTU in the internet. In: Proceedings of the IEEE Network Traffic Measurement and Analysis Conference (TMA) (2018)","DOI":"10.23919\/TMA.2018.8506538"},{"key":"2_CR13","doi-asserted-by":"crossref","unstructured":"Deering, S., Hinden, R.: RFC 8200: Internet protocol, version 6 (IPv6) specification (2017)","DOI":"10.17487\/RFC8200"},{"key":"2_CR14","unstructured":"Dumazet, E.: Use bigger hash table for IP ID generation (2021). https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/stable\/linux.git\/commit\/id=aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba"},{"key":"2_CR15","doi-asserted-by":"crossref","unstructured":"Feng, X., Fu, C., Li, Q., Sun, K., Xu, K.: Off-path TCP exploits of the mixed IPID assignment. In: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 1323\u20131335 (2020)","DOI":"10.1145\/3372297.3417884"},{"key":"2_CR16","doi-asserted-by":"crossref","unstructured":"Gasser, O., et al.: Clusters in the expanse: understanding and unbiasing IPv6 hitlists. In: Proceedings of the ACM Internet Measurement Conference (IMC), pp. 364\u2013378 (2018)","DOI":"10.1145\/3278532.3278564"},{"key":"2_CR17","doi-asserted-by":"crossref","unstructured":"Goni, F.: RFC 6274: security assessment of the internet protocol version 4, Internet eng (2011)","DOI":"10.17487\/rfc6274"},{"key":"2_CR18","doi-asserted-by":"crossref","unstructured":"Herzberg, A., Shulman, H.: Vulnerable delegation of DNS resolution. In: Proceedings of the European Symposium on Research in Computer Security, pp. 219\u2013236 (2013)","DOI":"10.1007\/978-3-642-40203-6_13"},{"key":"2_CR19","doi-asserted-by":"crossref","unstructured":"Hou, B., Cai, Z., Wu, K., Yang, T., Zhou, T.: 6scan: a high-efficiency dynamic internet-wide IPv6 scanner with regional encoding. IEEE\/ACM Trans. Netw. 1\u201316 (2023)","DOI":"10.1109\/TNET.2023.3233953"},{"issue":"2","key":"2_CR20","doi-asserted-by":"publisher","first-page":"383","DOI":"10.1109\/TNET.2012.2198887","volume":"21","author":"K Keys","year":"2013","unstructured":"Keys, K., Hyun, Y., Luckie, M., Claffy, K.: Internet-scale IPv4 alias resolution with MIDAR. IEEE\/ACM Trans. Netw. 21(2), 383\u2013399 (2013)","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"2_CR21","doi-asserted-by":"crossref","unstructured":"Luckie, M., Beverly, R.: The impact of router outages on the as-level Internet. In: Proceedings of the ACM Special Interest Group on Data Communication (SIGCOMM), pp. 488\u2013501 (2017)","DOI":"10.1145\/3098822.3098858"},{"key":"2_CR22","doi-asserted-by":"crossref","unstructured":"Luckie, M., Beverly, R., Brinkmeyer, W., Claffy, K.: Speedtrap: Internet-scale IPv6 alias resolution. In: Proceedings of the Passive and Active Network Measurement (PAM), pp. 119\u2013126 (2013)","DOI":"10.1145\/2504730.2504759"},{"key":"2_CR23","doi-asserted-by":"crossref","unstructured":"Mongkolluksamee, S., Fukuda, K., Pongpaibool, P.: Counting natted hosts by observing TCP\/IP field behaviors. In: Proceedings of the IEEE International Conference on Communications (ICC), pp. 1265\u20131270. IEEE (2012)","DOI":"10.1109\/ICC.2012.6364596"},{"key":"2_CR24","unstructured":"Morbitzer, M.: TCP idle scans in IPv6. Master\u2019s thesis, Radboud University Nijmegen (2013)"},{"key":"2_CR25","unstructured":"NCC, R.: Ripe atlas (2024). https:\/\/atlas.ripe.net\/"},{"issue":"10","key":"2_CR26","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1145\/2896816","volume":"59","author":"C Partridge","year":"2016","unstructured":"Partridge, C., Allman, M.: Ethical considerations in network measurement papers. Commun. ACM 59(10), 58\u201364 (2016)","journal-title":"Commun. ACM"},{"key":"2_CR27","doi-asserted-by":"crossref","unstructured":"Postel, J.: RFC0791: Internet protocol (1981)","DOI":"10.17487\/rfc0791"},{"key":"2_CR28","doi-asserted-by":"crossref","unstructured":"Salutari, F., Cicalese, D., Rossi, D.J.: A closer look at IP-ID behavior in the wild. In: Proceedings of the Passive and Active Network Measurement (PAM), pp. 243\u2013254 (2018)","DOI":"10.1007\/978-3-319-76481-8_18"},{"key":"2_CR29","doi-asserted-by":"crossref","unstructured":"Schulmann, H., Zhao, S.: Insights into sav implementations in the Internet. In: Proceedings of the Passive and Active Network Measurement (PAM), pp. 69\u201387 (2024)","DOI":"10.1007\/978-3-031-56252-5_4"},{"issue":"4","key":"2_CR30","doi-asserted-by":"publisher","first-page":"1629","DOI":"10.1109\/TNET.2022.3145040","volume":"30","author":"G Song","year":"2022","unstructured":"Song, G., et al.: DET: enabling efficient probing of IPv6 active addresses. IEEE\/ACM Trans. Netw. 30(4), 1629\u20131643 (2022)","journal-title":"IEEE\/ACM Trans. Netw."},{"issue":"4","key":"2_CR31","doi-asserted-by":"publisher","first-page":"133","DOI":"10.1145\/964725.633039","volume":"32","author":"N Spring","year":"2002","unstructured":"Spring, N., Mahajan, R., Wetherall, D.: Measuring ISP topologies with rocketfuel. ACM SIGCOMM Comput. Commun. Rev. 32(4), 133\u2013145 (2002)","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"2_CR32","doi-asserted-by":"crossref","unstructured":"Steger, L., Kuang, L., Zirngibl, J., Carle, G., Gasser, O.: Target acquired? Evaluating target generation algorithms for IPv6. In: Proceedings of the IEEE Network Traffic Measurement and Analysis Conference (TMA), pp. 1\u201310 (2023)","DOI":"10.23919\/TMA58422.2023.10199073"},{"key":"2_CR33","doi-asserted-by":"crossref","unstructured":"Touch, J.: RFC 6864: updated specification of the IPv4 id field (2013)","DOI":"10.17487\/rfc6864"},{"key":"2_CR34","doi-asserted-by":"crossref","unstructured":"West, M., McCann, S.: RFC 4413: TCP\/IP field behavior (2006)","DOI":"10.17487\/rfc4413"},{"key":"2_CR35","doi-asserted-by":"crossref","unstructured":"Yang, T., Cai, Z., Hou, B., Zhou, T.: 6forest: an ensemble learning-based approach to target generation for Internet-wide IPv6 scanning. In: 41st IEEE Conference on Computer Communications (IEEE INFOCOM) (2022)","DOI":"10.1109\/INFOCOM48880.2022.9796925"},{"key":"2_CR36","doi-asserted-by":"crossref","unstructured":"Zhang, X., Knockel, J., Crandall, J.R.: Onis: inferring TCP\/IP-based trust relationships completely off-path. In: Proceedings of the IEEE Conference on Computer Communications (INFOCOM), pp. 2069\u20132077 (2018)","DOI":"10.1109\/INFOCOM.2018.8486426"},{"key":"2_CR37","unstructured":"Zheng, X., et al.: Poison over troubled forwarders: a cache poisoning attack targeting $$\\{$$DNS$$\\}$$ forwarding devices. In: Proceedings of the USENIX Security Symposium (USENIX Security), pp. 577\u2013593 (2020)"},{"key":"2_CR38","doi-asserted-by":"crossref","unstructured":"Zirngibl, J., Steger, L., Sattler, P., Gasser, O., Carle, G.: Rusty clusters? Dusting an IPv6 research foundation. In: Proceedings of the ACM Internet Measurement Conference (IMC), pp. 395\u2013409 (2022)","DOI":"10.1145\/3517745.3561440"}],"container-title":["Lecture Notes in Computer Science","Passive and Active Measurement"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-85960-1_2","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,6]],"date-time":"2025-09-06T07:31:20Z","timestamp":1757143880000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-85960-1_2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031859595","9783031859601"],"references-count":38,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-85960-1_2","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"7 March 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"PAM","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Passive and Active Network Measurement","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"10 March 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12 March 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"pam2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/udesa.edu.ar\/pam25","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}