Detecting Third-Party Addresses in Traceroute Traces with IP Timestamp Option

  • Pietro Marchetta
  • Walter de Donato
  • Antonio Pescapé
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7799)


Traceroute is one of the most famous and widely adopted diagnostic tool for computer networks. Although traceroute is often used to infer links between Autonomous Systems (ASes), the presence of the so-called third-party (TP) addresses may induce the inference of false AS-level links. In this paper, we propose a novel active probing technique based on the IP timestamp option able to identify TP addresses. For evaluating both the applicability and the utility of the proposed technique, we perform a large-scale measurement campaign targeting – from multiple vantage points – more than 327K destinations belonging to about 14K ASes. The results show how TP addresses are very common and affect about 17% of AS-level links extracted from traceroute traces. Compared to a previously proposed heuristic method, our technique allows to identify many more TP addresses and to re-interpret part of its results.


Measurement Campaign Internet Topology Topology Discovery IEEE JSAC PlanetLab Node 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    The CAIDA AS Relationships Dataset (June 2012),
  2. 2.
    IP Address Hitlist, PREDICT ID USC-LANDER internet- address- hitlist- it47w-20120427, 2010-03-29 to 2012-05-30,
  3. 3.
    Augustin, B., Cuvellier, X., Orgogozo, B., Viger, F., Friedman, T., Latapy, M., Magnien, C., Teixeira, R.: Avoiding traceroute anomalies with paris traceroute. In: Proc. ACM SIGCOMM IMC (2006)Google Scholar
  4. 4.
    Augustin, B., Krishnamurthy, B., Willinger, W.: IXPs: mapped? In: ACM SIGCOMM IMC (2009)Google Scholar
  5. 5.
    Baker, F.: IETF RFC1812: Requirements for IP version 4 routersGoogle Scholar
  6. 6.
    Bavier, A., Bowman, M., Chun, B., Culler, D., Karlin, S., Muir, S., Peterson, L., Roscoe, T., Spalink, T., Wawrzoniak, M.: Operating system support for planetary-scale network services. In: NSDI (2004)Google Scholar
  7. 7.
    Botta, A., de Donato, W., Pescapè, A., Ventre, G.: Discovering topologies at router level: Part ii. In: GLOBECOM, pp. 2696–2701 (2007)Google Scholar
  8. 8.
    Chen, K., Choffnes, D., Potharaju, R., Chen, Y., Bustamante, F., Pei, D., Zhao, Y.: Where the sidewalk ends. In: Proc. ACM CoNEXT (2009)Google Scholar
  9. 9.
    Cymru, T.: IP to ASN mapping (2012),
  10. 10.
    de Donato, W., Marchetta, P., Pescapé, A.: A Hands-on Look at Active Probing Using the IP Prespecified Timestamp Option. In: Taft, N., Ricciato, F. (eds.) PAM 2012. LNCS, vol. 7192, pp. 189–199. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  11. 11.
    Donnet, B., Friedman, T.: Internet topology discovery: a survey. IEEE Communications Surveys and Tutorials (2007)Google Scholar
  12. 12.
    Gregori, E., Improta, A., Lenzini, L., Rossi, L., Sani, L.: On the incompleteness of the AS-level graph: a novel methodology for BGP route collector placement. In: Proc. ACM SIGCOMM IMC (2012)Google Scholar
  13. 13.
    He, Y., Siganos, G., Faloutsos, M., Krishnamurthy, S.: Lord of the links: a framework for discovering missing links in the internet topology. IEEE/ACM Transactions on Networking (2009)Google Scholar
  14. 14.
    Hyun, Y., Broido, A., Claffy, K.C.: On third-party addresses in traceroute paths. In: Proc. PAM (2003)Google Scholar
  15. 15.
    Hyun, Y., Broido, A., Claffy, K.C.: Traceroute and BGP AS path incongruities. Technical report, CAIDA (2003)Google Scholar
  16. 16.
    Katz-Bassett, E., Madhyastha, H.V., Adhikari, V.K., Scott, C., Sherry, J., van Wesep, P., Anderson, T.E., Krishnamurthy, A.: Reverse traceroute. In: Proc. NSDI (2010)Google Scholar
  17. 17.
    Luckie, M., Dhamdhere, A., Murrell, D., et al.: Measured impact of crooked traceroute. ACM SIGCOMM Computer Communication Review (2011)Google Scholar
  18. 18.
    Marchetta, P., de Donato, W., Pescapé, A.: Detecting third-party addresses in traceroute ip paths. In: Proc. ACM SIGCOMM (2012)Google Scholar
  19. 19.
    Marchetta, P., Mérindol, P., Donnet, B., Pescapè, A., Pansiot, J.-J.: Topology discovery at the router level: A new hybrid tool targeting isp networks. IEEE JSAC (2011)Google Scholar
  20. 20.
    Marchetta, P., Mérindol, P., Donnet, B., Pescapé, A., Pansiot, J.J.: Quantifying and Mitigating IGMP Filtering in Topology Discovery. In: Proc. IEEE GLOBECOM (2012)Google Scholar
  21. 21.
    Packet Clearing House. IXP directory,
  22. 22.
    PeeringDB. Exchange points list,
  23. 23.
    Postel, J.: Internet Protocol. RFC 791 (Standard) (September 1981)Google Scholar
  24. 24.
    Sherry, J., Katz-Bassett, E., Pimenova, M., Madhyastha, H.V., Anderson, T., Krishnamurthy, A.: Resolving ip aliases with prespecified timestamps. In: IMC 2010, pp. 172–178. ACM, New York (2010)Google Scholar
  25. 25.
    Tozal, M., Sarac, K.: Palmtree: An ip alias resolution algorithm with linear probing complexity. Computer Communications (2010)Google Scholar
  26. 26.
    Tozal, M., Sarac, K.: Tracenet: an internet topology data collector. In: Proc. ACM SIGCOMM IMC (2010)Google Scholar
  27. 27.
    Zhang, Y., Oliveira, R., Wang, Y., Su, S., Zhang, B., Bi, J., Zhang, H., Zhang, L.: A framework to quantify the pitfalls of using traceroute in as-level topology measurement. IEEE JSAC (2011)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Pietro Marchetta
    • 1
  • Walter de Donato
    • 1
  • Antonio Pescapé
    • 1
  1. 1.University of Napoli Federico IIItaly

Personalised recommendations