6th European Conference - Academic Conferences

Stephen Groat et al.
symmetric keys established through a handshake process between a trusted sender and receiver
enclave. This technique adds additional overhead due to repetition of the handshake process. A
dynamic addressing technique must minimize overhead to be feasible for implementation. We analyze
the factors that contribute to creating an effective dynamic addressing technique with the goal of
determining the most efficient approach.
4. Analysis of dynamic address factors
There are three factors that contribute to an attacker’s ability to detect a target host on a subnet. The
first factor is the number of dynamic bits in the address, which affects the size of the subnet. In a
small address space, it is trivial for an attacker to check each address. The second factor is how often
a target host’s address changes. If the address remains static, an attacker has as much time as
necessary to locate the host. The third factor is the density of the address space, or the number of
other hosts on an IP subnet. If an attacker does not know the target host’s address on a subnet,
multiple other addresses will make identifying the target more difficult.
For the purpose of our analysis, we investigate an attacker actively scanning an IP subnet with
unicast addresses to identify a single targeted host. There are other methods an attacker can use to
detect target hosts on a network. One such technique is a broadcast ping, allowed by IPv4. Many
gateway devices block broadcast pings. Another method is to passively scan a subnet with a packet
sniffer. This method has scope limitations as the attacker must have a presence on the same subnet
as the target host. A unicast scan is more likely since there are multiple methods of scans that avoid
common security measures implemented on networks.
4.1 Size of address
The larger the address space, the more time it takes an attacker, on average, to locate the target
address on an IP subnet. Table 1 illustrates this by comparing subnets of various sizes. In the table,
we use the three most common Internet Protocol version 4 (IPv4) classful address blocks as
examples. We also compare the typical subnet size used in IPv6. Scanning an entire class C address
space is trivial and can be accomplished in less than a minute while scanning an entire IPv6 subnet is
currently infeasible.
Table 1: Comparison of addresses of various sizes, the scan time is based on a sequential scan with
a 150 millisecond average round trip time for a single packet (GLORIAD 2010)
Address Type Address Size (bits) Address Size (hosts) Scan Time
IPv4 Class C Subnet 8 256 38 sec
IPv4 Class B Subnet 16 65,536 3 hrs
IPv4 Class A Subnet 24 16,777,200 29 days
IPv6 Subnet 64 1.845·10 19
8.77·10 10 yrs
So far we have mentioned the time it takes an attacker to scan the various address types in Table 1,
however, this is the time it takes an attacker to scan the entire address space. The expected amount
of time to locate a host is much less due to a paradox known as the birthday attack (Schneier 1996).
According to the birthday attack, an attacker can expect to locate a target host in attempts where
m is the number of bits in the address. What this means is that an attacker can expect to locate a host
on a class C subnet in 2.4 seconds, a class B subnet in 38 seconds, and a class A subnet in 10
minutes. A host on an IPv6 subnet can still expect to escape detection for over 73,500 years. No IPv4
host that is not defending against active scanning can have any expectation of remaining hidden for a
reasonable amount of time.
4.2 Frequency of address change
The more frequently an address changes, the more difficult it is, on average, for an attacker to
successfully locate and target a specific address. This is particularly true if the address changes more
rapidly than an attacker can scan the subnet. As mentioned in Section 4.1, a larger address space
takes longer to scan. It follows that addresses on a larger subnet need to change less frequently. To
understand the relationship between changing and non-changing addresses, we analyze the number
of attempts it takes an attacker to locate a static address on a subnet. Since the address is static, the
probability of an attacker guessing the address increases with each subsequent guess. This
86