Academic Commons

Articles

Worm propagation strategies in an IPv6 Internet

Bellovin, Steven Michael; Cheswick, Bill; Keromytis, Angelos D.

In recent years, the Internet has been plagued by a number of worms. One popular mechanism that worms use to detect vulnerable targets is random IP address-space probing. This is feasible in the current Internet due to the use of 32-bit addresses, which allow fast-operating worms to scan the entire address space in a matter of a few hours. The question has arisen whether or not their spread will be affected by the deployment of IPv6. In particular, it has been suggested that the 128-bit IPv6 address space (relative to the current 32-bit IPv4 address space) will make life harder for the worm writers: assuming that the total number of hosts on the Internet does not suddenly increase by a similar factor, the work factor for finding a target in an IPv6 Internet will increase by approximately 296, rendering random scanning seemingly prohibitively expensive.

Subjects

Files

Also Published In

Title
;login:

More About This Work

Academic Units
Computer Science
Published Here
May 10, 2010