IP anycast replicates an address at multiple locations to reduce latency and enhance resilience. Due to anycast's crucial role in the modern Internet, earlier research introduced tools to perform anycast censuses. The first, iGreedy, uses latency measurements from geographically dispersed locations to map anycast deployments. The second, MAnycast2, uses anycast to perform a census of other anycast networks. MAnycast2's advantage is speed and coverage but suffers from problems with accuracy, while iGreedy is highly accurate but slower using author-defined probing rates and costlier. In this paper we address the shortcomings of both systems and present LACeS (Longitudinal Anycast Census System). Taking MAnycast2 as a basis, we completely redesign its measurement pipeline, and add support for distributed probing, additional protocols (DNS over UDP, TCP SYN/ACK, and IPv6) and latency measurements similar to iGreedy. We validate LACeS on an anycast testbed with 32 globally distributed nodes, compare against an external anycast production deployment, extensive latency measurements with RIPE Atlas and cross-check over 60

Active Internet measurement is not a zero-risk activity, and access to Internet measurement vantage points typically requires navigating trust relationships among actors involved in deploying, operating, and using the infrastructure. Operators of vantage points (VPs) must balance VP capability against who gets access: the more capable a vantage point, the riskier it is to allow access. We propose an integrated active measurement programming environment that: (1) allows a platform operator to specify the measurements that a user can run, which allows the platform operator to communicate to the VP's host what their vantage point will do, and (2) provides users with reference implementations of measurement functions that act as building blocks to more complex measurements. We first review active measurement infrastructures and how technical and usability goals have evolved over the years. We prototype and deploy an integrated active measurement programming environment on an existing measurement infrastructure, and illustrate its potential with several case studies.

Spoofed traffic has been identified as one of the main issues of concern for network hygiene nowadays, as it facilitates Distributed Denial-of-Service (DDoS) attacks by hiding their origin and complicating forensic investigations. Some indicators of poor network hygiene are packets with Bogon or Martian source addresses representing either misconfigurations or spoofed packets. Despite the development of Source Address Validation (SAV) techniques and guidelines such as BCP 38 and BCP 84, Bogons are often overlooked in the filtering practices of network operators. This study uses traceroute measurements from the CAIDA Ark dataset, enriched with historical BGP routing information from RIPE RIS and RouteViews, to investigate the prevalence of Bogon addresses over seven years (2017-2023). Our analysis reveals widespread non-compliance with best practices, with Bogon traffic detected across thousands of ASes. Notably, 82.69 paths containing Bogon IPs, primarily RFC1918 addresses. Additionally, 19.70 of all analyzed traceroutes include RFC1918 addresses, while smaller proportions involve RFC6598 (1.50 more than 13,000 unique ASes transiting Bogon traffic, with only 11.64 appearing in more than half of the measurements. Cross-referencing with the Spoofer project and MANRS initiatives shows a concerning gap: 62.67 that do not filter packets with Bogon sources are marked as non-spoofable, suggesting incomplete SAV implementation. Our contributions include an assessment of network hygiene using the transiting of Bogon packets as a metric, an analysis of the main types of Bogon addresses found in traceroutes, and several proposed recommendations to address the observed gaps, enforcing the need for stronger compliance with best practices to improve global network security.

BGP communities are widely used by operators to encode routing metadata for traffic engineering, policy enforcement, and operational debugging. However, ≈90% of observed communities lack public documentation, limiting their utility for research and operational analysis. Among these, city-level communities offer valuable geographic insight into routing behavior, yet remain largely untapped. In this paper, we develop a scalable method to infer the geographic meaning of undocumented city communities using BGP data. We validate our approach against a ground truth dataset covering 1,482 city communities and through operator feedback. Applied to data from May 2025, our algorithm infers the locations of 80% of city communities with a precision of 70 km or better. We publish all code and datasets to support reproducibility and further research.

Although Internet routing security best practices have recently seen auspicious increases in uptake, ISPs have limited incentives to deploy them. They are operationally complex and expensive to implement, provide little competitive advantage, and protect only against origin hijacks, leaving unresolved the more general threat of path hijacks. We propose a new approach that achieves four design goals: improved incentive alignment to implement best practices; protection against path hijacks; expanded scope of such protection to customers of those engaged in the practices; and reliance on existing capabilities rather than needing complex new software in every participating router. Our proposal leverages an existing coherent core of interconnected ISPs to create a zone of trust, a topological region that protects not only all networks in the region, but all directly attached customers of those networks. Customers benefit from choosing ISPs committed to the practices, and ISPs thus benefit from committing to the practices. We compare our approach to other schemes, and discuss how a related proposal, ASPA, could be used to increase the scope of protection our scheme achieves. We hope this proposal inspires discussion of how the industry can make practical, measurable progress against the threat of route hijacks in the short term by leveraging institutionalized cooperation rooted in transparency and accountability.

Department of Defense (DOD) use of commercial networks entails unprecedented reliance on untrusted third-party communications infrastructure, and the associated risk of exposing DOD communications to an adversary. Traversing adversary-controlled infrastructure allows DOD’s adversaries to recognize, disrupt, or extract intelligence even from encrypted communications. The resulting arms race of obfuscation vs intelligence techniques is inherently limited: with each new obfuscation, DOD can never know if it fools the adversary, or if the adversary is lulling DOD into a false sense of security.

Department of Defense (DOD) use of commercial networks entails unprecedented reliance on untrusted third-party communications infrastructure, and the associated risk of exposing DOD communications to an adversary. Traversing adversary-controlled infrastructure allows DOD's adversaries to recognize, disrupt, or extract intelligence even from encrypted communications. The resulting arms race of obfuscation vs intelligence techniques has an inherent limitation: with each new obfuscation, DOD can never know if it fools the adversary, or if the adversary is simply lulling DOD into a false sense of security. We believe the next great capability leap for operating through commercial networks will likely come from sophisticated analytics that provide situational awareness of the threats within the communications infrastructure, and implementations that dynamically route communications along benign paths. These systems will restructure communication paths to avoid adversary-controlled infrastructure within the cellular networks and the broader Internet, adding depth to existing DOD defenses and keeping communications unobservable by the adversary. In this paper, we describe our vision for this emerging conceptual framework. We first describe the threat model for DOD communications and use cases that motivate our approach. We then discuss specific threats for each component of the cellular communication infrastructure-radio access network, mobile core, and Internet-and our vision for securing communications against those threats. For the radio access network and Internet components, we also describe proofs-of-concept for our proposed approaches, demonstrating their feasibility.

BGP communities allow operators to influence routing decisions made by other networks (action communities) and to annotate their network's routing information with metadata such as where each route was learned or the relationship the network has with their neighbor (information communities). BGP communities also help researchers understand complex Internet routing behaviors. However, there is no standard convention for how operators assign community values, and significant efforts to scalably infer community meanings have ignored this high-level classification. We discovered that doing so comes at significant cost in accuracy, of both inference and validation. To advance this narrow but powerful direction in Internet infrastructure research, we design and validate an algorithm to execute this first fundamental step: inferring whether a BGP community is action or information. We applied our method to 78,480 community values observed in public BGP data for May 2023. Validating our inferences (24,376 action and 54,104 informational communities) against available ground truth (6,259 communities) we find that our method classified 96.5% correctly. We found that the precision of a state-of-the-art location community inference method increased from 68.2% to 94.8% with our classifications. We publicly share our code, dictionaries, inferences, and datasets to enable the community to benefit from them.

Regional access networks play an essential role in connecting both wireline and mobile users to the Internet. Today’s access networks support 5G cellular phones, cloud services, hospital and financial services, and remote work essential to the modern economy. Yet long-standing economic and architectural constraints produce points of limited redundancy that leave these networks exposed to targeted physical attacks resulting in widespread outages. This risk was dramatically shown in December 2020, when a bomb destroyed part of AT&T’s regional access network in Nashville, Tennessee disabling 911 emergency dispatch, air traffic control, hospital networks, and credit card processing, among other services. We combine new techniques for analyzing access-network infrastructure deployments with measurements of large-scale outages to demonstrate the feasibility and quantify potential impacts of targeted attacks. Our study yields insights into physical attack surfaces and resiliency limits of regional access networks. We analyze potential approaches to mitigate the risks we identify and discuss drawbacks identified by network operators. We hope that our empirical evaluation will inform risk assessments and operational practices, as well as motivate further analyses of this critical infrastructure.

We analyze the properties of 712 prefixes that appeared in Spamhaus' Don't Route Or Peer (DROP) list over a nearly three-year period from June 2019 to March 2022. We show that attackers are subverting multiple defenses against malicious use of address space, including creating fraudulent Internet Routing Registry records for prefixes shortly before using them. Other attackers disguised their activities by announcing routes with spoofed origin ASes consistent with historic route announcements, and in one case, with the ASN in a Route Origin Authorization. We quantify the substantial and actively-exploited attack surface in unrouted address space, which warrants reconsideration of RPKI eligibility restrictions by RIRs, and reconsideration of AS0 policies by both operators and RIRs.

Having a consistent application stack for hardware from multiple vendors allows operators to build simpler, more stable networks. However, due to the limitations of low cost, fixed-function networking hardware, creating portable controlplane software with current SDN standards requires accepting limited functionality, navigating inconsistent implementations, or using powerful, flexible hardware that is prohibitively expensive in many scenarios. This paper describes Shoehorn, a system for creating portable SDN control-plane software for low cost hardware. Shoehorn allows control-plane software to define a hardware-agnostic virtual pipeline in P4 that can be algorithmically translated to control diverse low-cost hardware without a significant impact on memory usage or the rate that tables can be updated. To demonstrate the effectiveness of Shoehorn, we created virtual pipelines for a variety of existing control-plane software, and mapped them to low cost hardware. We found that the virtual pipelines could be supported by hardware from multiple vendors in almost all cases.

IP spoofing, sending IP packets with a false source IP address, continues to be a primary attack vector for large-scale Denial of Service attacks. To combat spoofing, various interventions have been tried to increase the adoption of source address validation (SAV) among network operators. How can SAV deployment be increased? In this work, we conduct the first randomized control trial to measure the effectiveness of various notification mechanisms on SAV deployment. We include new treatments using nudges and channels, previously untested in notification experiments. Our design reveals a painful reality that contrasts with earlier observational studies: none of the notification treatments significantly improved SAV deployment compared to the control group. We explore the reasons for these findings and report on a survey among operators to identify ways forward. A portion of the operators indicate that they do plan to deploy SAV and ask for better notification mechanisms, training, and support materials for SAV implementation.

Internet Exchange Points (IXPs) play an essential role in the Internet, providing a fabric for thousands of Autonomous Systems (ASes) to interconnect. Initially designed to keep local traffic local, IXPs now interconnect ASes all over the world, and the premise that IXP routes should be shorter and faster than routes through a transit provider may not be valid anymore. Using BGP views from eight IXPs (three in Brazil, two in the U.S., and one each in London, Amsterdam, and Johannesburg), a transit connection at each of these locations, and latency measurements we collected in May 2021, we compare the latency to reach the same addresses using routes from remote peers, local peers, and transit providers. For four of these IXPs, at least 71.4% of prefixes advertised by remote peers also had a local peering route, BGP generally preferred the remote route due to its shorter AS path, but the local route had lower latency than the remote route in the majority of cases. When a remote route was the only peering route available at an IXP, it had slightly lower latency than a corresponding transit route available outside the IXP for >57.6% of the prefixes for seven of the eight IXPs.

Deploying traffic engineering (TE) in the context of multi-controller SDN (MCSDN) or on WANs is challenging due to state and consistency requirements. For example, using strong consistency to ensure that information is always up-to-date introduces significant performance overheads. However, using eventual consistency to reduce synchronisation time comes at the expense of using outdated information to make decisions. We design and implement Helix, an MCSDN system that supports deployment on WANs. Helix offloads operations closer to the data plane and minimises shared state between devices, allowing it to tolerate high latency and mitigate state consistency concerns. We develop a lightweight TE algorithm that requires minimal state, making it suitable for use with Helix. Our simulation results show that Helix reduces congestion loss by up to 1.6x and performs 12x fewer path changes compared to CSPF.

Geolocating Internet routers is a long-standing and notoriously difficult challenge, and current solutions lack the accuracy and adaptability to yield reliable results. We revisit this problem, designing a solution capable of accurately and comprehensively extracting geographic information that network operators embed into router interface hostnames. We train our system using dictionaries that map geographic codes to known locations, and constrain inferences with delay measurements conducted from a distributed set of vantage points. While most operators use known geographic codes, some devise their own mnemonic codes for locations, which our system also extracts and interprets. We evaluate our system on Internet-wide topology datasets, automatically learning regular expressions (regexes) for 1023 different domain suffixes with IPv4 routers, and 241 different domain suffixes with IPv6 routers. We received ground truth from operators of 13 domain suffixes, all of whom confirmed the correctness of our learned regexes, and that our system correctly interpreted 78.6% of the custom geographic codes. For these 13 suffixes, our solution more accurately extracts and interprets geographic information than the previous state-of-the-art, correctly geolocating 94.0% of router hostnames with a geohint compared to DRoP (56.6%) and HLOC (73.1%). This work advances the ability of researchers and network operators to characterize the location of critical Internet infrastructure, a foundational building block of network performance, security, and resilience analysis. We release the source code of our system and our inferred regexes.