{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:30:21Z","timestamp":1785511821151,"version":"3.56.0"},"reference-count":70,"publisher":"Association for Computing Machinery (ACM)","issue":"CoNEXT3","funder":[{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"crossref","award":["16KIS2332K"],"award-info":[{"award-number":["16KIS2332K"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"crossref","award":["16KIS1815"],"award-info":[{"award-number":["16KIS1815"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"crossref","award":["16KIS2333"],"award-info":[{"award-number":["16KIS2333"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["16KIS2332K"],"award-info":[{"award-number":["16KIS2332K"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["16KIS1815"],"award-info":[{"award-number":["16KIS1815"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["16KIS2333"],"award-info":[{"award-number":["16KIS2333"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Netw."],"published-print":{"date-parts":[[2025,9,3]]},"abstract":"<jats:p>Scanners are daily visitors of public IPv4 hosts. Scanning IPv6 nodes successfully is still a challenge, which an increasing crowd of actors tries to master. In this paper, we analyze IPv6 scanning under various network conditions to disclose the impact on scanning. We deploy four IPv6 network telescopes, including a reactive \/48 telescope and a proactive \/32 telescope that is periodically reconfigured by changing BGP announcements. We provide a longitudinal study of eleven months and classify the observed scanners w.r.t. their temporal behavior, their target and network selection strategies, as well as their individual tools, fingerprints, and correlations across categories. We find that silent subnets of larger covering prefixes remain mainly invisible, whereas BGP prefix announcements quickly attract attention by scanners. Based on our findings, we derive operational guidance on how to deploy network telescopes to increase visibility for IPv6 scanners and understand corresponding biases.<\/jats:p>","DOI":"10.1145\/3749215","type":"journal-article","created":{"date-parts":[[2025,9,4]],"date-time":"2025-09-04T13:42:01Z","timestamp":1756993321000},"page":"1-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP Signals"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-5041-050X","authenticated-orcid":false,"given":"Isabell","family":"Egloff","sequence":"first","affiliation":[{"name":"HAW Hamburg, Hamburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1676-8108","authenticated-orcid":false,"given":"Raphael","family":"Hiesgen","sequence":"additional","affiliation":[{"name":"HAW Hamburg, Hamburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-3698-1342","authenticated-orcid":false,"given":"Maynard","family":"Koch","sequence":"additional","affiliation":[{"name":"TU Dresden, Dresden, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0956-7885","authenticated-orcid":false,"given":"Thomas C.","family":"Schmidt","sequence":"additional","affiliation":[{"name":"HAW Hamburg, Hamburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3825-2807","authenticated-orcid":false,"given":"Matthias","family":"W\u00e4hlisch","sequence":"additional","affiliation":[{"name":"TU Dresden, Dresden, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,9,4]]},"reference":[{"key":"e_1_2_2_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1298306.1298316"},{"key":"e_1_2_2_2_1","volume-title":"James Dray, and San Vo.","author":"Bassham Lawrence","year":"2010","unstructured":"Lawrence Bassham, Andrew Rukhin, Juan Soto, James Nechvatal, Miles Smid, Elaine Barker, Stefan Leigh, Mark Levenson, Mark Vangel, David Banks, Nathanael Alan Heckert, James Dray, and San Vo. 2010. A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications. Special Publication NIST SP 800--22. National Institute of Standards & Technology, Gaithersburg, MD, US."},{"key":"e_1_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815702"},{"key":"e_1_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987479"},{"key":"e_1_2_2_5_1","unstructured":"Robert Beverly. 2025. YARRP. https:\/\/github.com\/cmand\/yarrp"},{"key":"e_1_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278559"},{"key":"e_1_2_2_7_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2023.109355"},{"key":"e_1_2_2_8_1","unstructured":"CAIDA. 2007. Archipelago Project. https:\/\/www.caida.org\/projects\/ark\/"},{"key":"e_1_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3625403.3625426"},{"key":"e_1_2_2_10_1","unstructured":"Cisco. 2025. Cisco Umbrella Popularity List. https:\/\/s3-us-west-1.amazonaws.com\/umbrella-static\/index.html"},{"key":"e_1_2_2_11_1","volume-title":"6GCVAE: Gated Convolutional Variational Autoencoder For IPv6 Target Generation. In 2020 24th PAKDD","author":"Cui Tianyu","unstructured":"Tianyu Cui, Gaopeng Gou, and Gang Xiong. 2020. 6GCVAE: Gated Convolutional Variational Autoencoder For IPv6 Target Generation. In 2020 24th PAKDD. Springer, Springer International Publishing, Cham, 609--622."},{"key":"e_1_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM42981.2021.9488912"},{"key":"e_1_2_2_13_1","volume-title":"ECML PKDD","author":"Cui Tianyu","year":"2020","unstructured":"Tianyu Cui, Gang Xiong, Gaopeng Gou, Junzheng Shi, and Wei Xia. 2020. 6VECLM: Language Modeling In Vector Space For IPv6 Target Generation. In ECML PKDD 2020. Springer, Springer International Publishing, Cham, 192-- 207."},{"key":"e_1_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504732"},{"key":"e_1_2_2_15_1","volume-title":"Proc. of the 23rd USENIX Conference on Security Symposium","author":"Durumeric Zakir","unstructured":"Zakir Durumeric, Michael Bailey, and J. Alex Halderman. 2014. An Internet-Wide View of Internet-Wide Scanning. In Proc. of the 23rd USENIX Conference on Security Symposium (San Diego, CA). USENIX Assoc., Berkeley, CA, USA, 65--78."},{"key":"e_1_2_2_16_1","volume-title":"Proc. of the 22nd USENIX Security Symposium. USENIX Assoc.","author":"Durumeric Zakir","unstructured":"Zakir Durumeric, Eric Wustrow, and J. Alex Halderman. 2013. ZMap: Fast Internet-Wide Scanning and its Security Applications. In Proc. of the 22nd USENIX Security Symposium. USENIX Assoc., Berkeley, CA, USA, 605--620."},{"key":"e_1_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICISP.2006.14"},{"key":"e_1_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987445"},{"key":"e_1_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278553"},{"key":"e_1_2_2_20_1","volume-title":"Proc. of TMA (Louvain La Neuve, Belgium). IFIP","author":"Gasser Oliver","year":"2016","unstructured":"Oliver Gasser, Quirin Scheitle, Sebastian Gebhard, and Georg Carle. 2016. Scanning the IPv6 Internet: Towards a Comprehensive Hitlist. In Proc. of TMA (Louvain La Neuve, Belgium). IFIP, Laxenburg, MD, Austria, 1--8."},{"key":"e_1_2_2_21_1","unstructured":"Alpha Strike Labs GmbH. 2017. Alpha Strike Labs. website. https:\/\/www.alphastrike.io\/en\/"},{"key":"e_1_2_2_22_1","doi-asserted-by":"publisher","unstructured":"F. Gont and T. Chown. 2016. Network Reconnaissance in IPv6 Networks. RFC 7707. IETF. https:\/\/doi.org\/10.17487\/RFC7707","DOI":"10.17487\/RFC7707"},{"key":"e_1_2_2_23_1","unstructured":"hbn1987. 2025. 6Scan. https:\/\/github.com\/hbn1987\/6Scan"},{"key":"e_1_2_2_24_1","unstructured":"hbn1987. 2025. Htrace6. https:\/\/github.com\/hbn1987\/6Scan\/tree\/master\/Htrace6"},{"key":"e_1_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3646547.3688451"},{"key":"e_1_2_2_26_1","volume-title":"Proc. of 31st USENIX Security Symposium. USENIX Association","author":"Hiesgen Raphael","year":"2022","unstructured":"Raphael Hiesgen, Marcin Nawrocki, Alistair King, Alberto Dainotti, Thomas C. Schmidt, and Matthias W\u00e4hlisch. 2022. Spoki: Unveiling a New Wave of Scanners through a Reactive Network Telescope. In Proc. of 31st USENIX Security Symposium. USENIX Association, Berkeley, CA, USA, 431--448. https:\/\/www.usenix.org\/system\/files\/sec22-hiesgen.pdf"},{"key":"e_1_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2024.3440188"},{"key":"e_1_2_2_28_1","doi-asserted-by":"publisher","unstructured":"R. Hinden and S. Deering. 2006. IP Version 6 Addressing Architecture. RFC 4291. IETF. https:\/\/doi.org\/10.17487\/RFC4291","DOI":"10.17487\/RFC4291"},{"key":"e_1_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3646547.3688420"},{"key":"e_1_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM42981.2021.9488794"},{"key":"e_1_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2023.3233953"},{"key":"e_1_2_2_32_1","unstructured":"Van Jacobson. 1987. traceroute. https:\/\/linux.die.net\/man\/8\/traceroute6"},{"key":"e_1_2_2_33_1","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Kaspereit Jonas","year":"2024","unstructured":"Jonas Kaspereit, Gurur \u00d6ndar\u00f6, Gustavo Luvizotto Cesar, Simon Ebbers, Fabian Ising, Christoph Saatjohann, Mattijs Jonker, Ralph Holz, and Sebastian Schinzel. 2024. LanDscAPe: Exploring LDAP Weaknesses and Data Leaks at Internet Scale. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 1225--1242. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/kaspereit"},{"key":"e_1_2_2_34_1","doi-asserted-by":"crossref","unstructured":"M. Lepinski and S. Kent. 2012. An Infrastructure to Support Secure Internet Routing. RFC 6480. IETF. https:\/\/doi.org\/10. 17487\/RFC6480","DOI":"10.17487\/rfc6480"},{"key":"e_1_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48987.2021.00025"},{"key":"e_1_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICEIEC51955.2021.9463724"},{"key":"e_1_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109987"},{"key":"e_1_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC58397.2023.10218311"},{"key":"e_1_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2019.03.010"},{"key":"e_1_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3718958.3754347"},{"key":"e_1_2_2_41_1","unstructured":"MaxMind Inc. 2025. MaxMind -- GeoLite Country. https:\/\/dev.maxmind.com\/geoip\/geolite2-free-geolocation-data"},{"key":"e_1_2_2_42_1","doi-asserted-by":"publisher","unstructured":"T. Narten R. Draves and S. Krishnan. 2007. Privacy Extensions for Stateless Address Autoconfiguration in IPv6. RFC 4941. IETF. https:\/\/doi.org\/10.17487\/RFC4941","DOI":"10.17487\/RFC4941"},{"key":"e_1_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00041"},{"key":"e_1_2_2_44_1","unstructured":"RIPE NCC. 2024. RIPEstat. https:\/\/stat.ripe.net\/ui2013\/"},{"key":"e_1_2_2_45_1","unstructured":"RIPE NCC. 2025. RIPE Atlas software probe. https:\/\/github.com\/RIPE-NCC\/ripe-atlas-software-probe"},{"key":"e_1_2_2_46_1","unstructured":"FRRouting Project. 2025. FRR. https:\/\/frrouting.org"},{"key":"e_1_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561452"},{"key":"e_1_2_2_48_1","unstructured":"RIPE NCC. 2010. What is RIPE Atlas? https:\/\/atlas.ripe.net\/about\/"},{"key":"e_1_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSC59246.2023.10162033"},{"key":"e_1_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-44081-7_1"},{"key":"e_1_2_2_51_1","unstructured":"SI6 Networks. 2016. IPv6 Toolkit. https:\/\/www.si6networks.com\/research\/tools\/ipv6toolkit\/."},{"key":"e_1_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2022.3145040"},{"key":"e_1_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.23919\/TMA58422.2023.10199073"},{"key":"e_1_2_2_54_1","volume-title":"Visibility of IPv4 and IPv6 Prefix Lengths","author":"Strowes Stephen","year":"2019","unstructured":"Stephen Strowes. 2019. Visibility of IPv4 and IPv6 Prefix Lengths in 2019. RIPE Labs article. RIPE. https:\/\/labs.ripe.net\/ author\/stephen_strowes\/visibility-of-ipv4-and-ipv6-prefix-lengths-in-2019\/"},{"key":"e_1_2_2_55_1","volume-title":"Proc. of TMA. IFIP","author":"Strowes Stephen D","year":"2020","unstructured":"Stephen D Strowes, Ren\u00e9 Wilhelm, Florian Obser, Riccardo Stagni, Agust\u00edn Formoso, and Emile Aben. 2020. Debogonising 2a10::\/12 Analysis of one week's visibility of a new \/12. In Proc. of TMA. IFIP, Laxenburg, MD, Austria, 1--9."},{"key":"e_1_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/3749221"},{"key":"e_1_2_2_57_1","volume-title":"Proc. of the USENIX Security Symposium. USENIX Association","author":"Tanveer Hammas Bin","year":"2023","unstructured":"Hammas Bin Tanveer, Rachee Singh, Paul Pearce, and Rishab Nithyanand. 2023. Glowing in the Dark: Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild. In Proc. of the USENIX Security Symposium. USENIX Association, Anaheim, CA, 6221--6237. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/bin-tanveer"},{"key":"e_1_2_2_58_1","unstructured":"Yang Tao. 2025. 6Seeks. https:\/\/github.com\/6Seeks\/6Seeks"},{"key":"e_1_2_2_59_1","unstructured":"Telia. 2024. Telia Looking Glass. https:\/\/lg.telia.net\/"},{"key":"e_1_2_2_60_1","doi-asserted-by":"publisher","unstructured":"S. Thomson T. Narten and T. Jinmei. 2007. IPv6 Stateless Address Autoconfiguration. RFC 4862. IETF. https: \/\/doi.org\/10.17487\/RFC4862","DOI":"10.17487\/RFC4862"},{"key":"e_1_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2015.48"},{"key":"e_1_2_2_62_1","unstructured":"University of Oregon. 2017. Route Views Project. http:\/\/www.routeviews.org\/."},{"key":"e_1_2_2_63_1","volume-title":"Proc. of the 33rd USENIX Security Symposium. USENIX Association","author":"Williams Grant","year":"2024","unstructured":"Grant Williams, Mert Erdemir, Amanda Hsu, Shraddha Bhat, Abhishek Bhaskar, Frank Li, and Paul Pearce. 2024. 6Sense: Internet-Wide IPv6 Scanning and its Security Applications. In Proc. of the 33rd USENIX Security Symposium. USENIX Association, San Diego, CA, USA."},{"key":"e_1_2_2_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/3744969.3748443"},{"key":"e_1_2_2_65_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM52122.2024.10621168"},{"key":"e_1_2_2_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796925"},{"key":"e_1_2_2_67_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108666"},{"key":"e_1_2_2_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/NNICE61279.2024.10498956"},{"key":"e_1_2_2_69_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-56249-5_4"},{"key":"e_1_2_2_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745"}],"container-title":["Proceedings of the ACM on Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3749215","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,21]],"date-time":"2026-03-21T04:08:50Z","timestamp":1774066130000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3749215"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,3]]},"references-count":70,"journal-issue":{"issue":"CoNEXT3","published-print":{"date-parts":[[2025,9,3]]}},"alternative-id":["10.1145\/3749215"],"URL":"https:\/\/doi.org\/10.1145\/3749215","relation":{},"ISSN":["2834-5509"],"issn-type":[{"value":"2834-5509","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,3]]},"assertion":[{"value":"2025-09-04","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}