{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T01:59:54Z","timestamp":1784599194019,"version":"3.55.0"},"reference-count":36,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2018,5,1]],"date-time":"2018-05-01T00:00:00Z","timestamp":1525132800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGCOMM Comput. Commun. Rev."],"published-print":{"date-parts":[[2018,5]]},"abstract":"<jats:p>Internet-wide scanning depends on a notion of liveness: does a target IP address respond to a probe packet? However, the interpretation of such responses, or lack of them, is nuanced and depends on multiple factors, including: how we probed, how different protocols in the network stack interact, the presence of filtering policies near the target, and temporal churn in IP responsiveness. Although often neglected, these factors can significantly affect the results of active measurement studies. We develop a taxonomy of liveness which we employ to develop a method to perform concurrent IPv4 scans using ICMP, five TCP-based, and two UDP-based protocols, comprehensively capturing all responses to our probes, including negative and cross-layer responses. Leveraging our methodology, we present a systematic analysis of liveness and how it manifests in active scanning campaigns, yielding practical insights and methodological improvements for the design and the execution of active Internet measurement studies.<\/jats:p>","DOI":"10.1145\/3213232.3213234","type":"journal-article","created":{"date-parts":[[2018,5,2]],"date-time":"2018-05-02T12:21:37Z","timestamp":1525263697000},"page":"2-9","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":33,"title":["Scanning the Internet for Liveness"],"prefix":"10.1145","volume":"48","author":[{"given":"Shehar","family":"Bano","sequence":"first","affiliation":[{"name":"University College London"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Philipp","family":"Richter","sequence":"additional","affiliation":[{"name":"MIT"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mobin","family":"Javed","sequence":"additional","affiliation":[{"name":"LUMS Pakistan, ICSI Berkeley"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Srikanth","family":"Sundaresan","sequence":"additional","affiliation":[{"name":"Princeton University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zakir","family":"Durumeric","sequence":"additional","affiliation":[{"name":"Stanford University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Steven J.","family":"Murdoch","sequence":"additional","affiliation":[{"name":"University College London"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Richard","family":"Mortier","sequence":"additional","affiliation":[{"name":"University of Cambridge"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Vern","family":"Paxson","sequence":"additional","affiliation":[{"name":"UC Berkeley, ICSI Berkeley"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2018,5]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664285"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1298306.1298314"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644923"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/1851182.1851196"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.38"},{"key":"e_1_2_1_7_1","unstructured":"TR-069 CPE WAN Management Protocol. https:\/\/www.broadband-forum.org\/technical\/download\/TR-069_Amendment-5.pdf.  TR-069 CPE WAN Management Protocol. https:\/\/www.broadband-forum.org\/technical\/download\/TR-069_Amendment-5.pdf."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/2567561.2567568"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2016.2559218"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813703"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504755"},{"key":"e_1_2_1_12_1","first-page":"620","volume-title":"Proceedings of the 22Nd USENIX Conference on Security, SEC'13","author":"Durumeric Zakir","year":"2013"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879195"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2000.832534"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.5555\/1532940.1532944"},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the 21st USENIX Conference on Security Symposium, Security'12","author":"Heninger Nadia","year":"2012"},{"key":"e_1_2_1_18_1","volume-title":"PAM 2001","author":"Huffaker B.","year":"2001"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23342"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815683"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879156"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1452520.1452557"},{"key":"e_1_2_1_23_1","volume-title":"Guofei Gu. CyberProbe: Towards Internet-Scale Active Detection of Malicious Servers. In Proceedings of NDSS 2014","author":"Nappa Antonio","year":"2014"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987461"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028790"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/280549.280555"},{"key":"e_1_2_1_27_1","doi-asserted-by":"crossref","unstructured":"J. Postel. Internet Control Message Protocol. RFC 792 September 1981. https:\/\/tools.ietf.org\/html\/rfc792.   J. Postel. Internet Control Message Protocol. RFC 792 September 1981. https:\/\/tools.ietf.org\/html\/rfc792.","DOI":"10.17487\/rfc0777"},{"key":"e_1_2_1_28_1","doi-asserted-by":"crossref","unstructured":"J. Postel. Transmission Control Protocol. RFC 793 September 1981. https:\/\/tools.ietf.org\/html\/rfc793.  J. Postel. Transmission Control Protocol. RFC 793 September 1981. https:\/\/tools.ietf.org\/html\/rfc793.","DOI":"10.17487\/rfc0793"},{"key":"e_1_2_1_29_1","volume-title":"ScanSSH - Scanning the Internet for SSH Servers. In 16th USENIX Systems Administration Conference (LISA)","author":"Provos N.","year":"2001"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987473"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987474"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2011.111006"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1096536.1096546"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/633025.633039"},{"key":"e_1_2_1_37_1","doi-asserted-by":"crossref","unstructured":"P. Srisuresh B. Ford S. Sivakumar and S. Guha. NAT Behavioral Requirements for ICMP. RFC 5508 (Best Current Practice) April 2009. Updated by RFC 7857.  P. Srisuresh B. Ford S. Sivakumar and S. Guha. NAT Behavioral Requirements for ICMP. RFC 5508 (Best Current Practice) April 2009. Updated by RFC 7857.","DOI":"10.17487\/rfc5508"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.Congress.2014.34"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159956"},{"key":"e_1_2_1_40_1","unstructured":"ZMap. https:\/\/github.com\/zmap\/zmap\/.  ZMap. https:\/\/github.com\/zmap\/zmap\/."}],"container-title":["ACM SIGCOMM Computer Communication Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3213232.3213234","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3213232.3213234","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:08:12Z","timestamp":1750212492000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3213232.3213234"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,5]]},"references-count":36,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2018,5]]}},"alternative-id":["10.1145\/3213232.3213234"],"URL":"https:\/\/doi.org\/10.1145\/3213232.3213234","relation":{},"ISSN":["0146-4833"],"issn-type":[{"value":"0146-4833","type":"print"}],"subject":[],"published":{"date-parts":[[2018,5]]},"assertion":[{"value":"2018-05-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}