Skip to main content

Detecting Third-Party Addresses in Traceroute Traces with IP Timestamp Option

  • Conference paper
Passive and Active Measurement (PAM 2013)

Part of the book series: Lecture Notes in Computer Science ((LNCCN,volume 7799))

Included in the following conference series:


Traceroute is one of the most famous and widely adopted diagnostic tool for computer networks. Although traceroute is often used to infer links between Autonomous Systems (ASes), the presence of the so-called third-party (TP) addresses may induce the inference of false AS-level links. In this paper, we propose a novel active probing technique based on the IP timestamp option able to identify TP addresses. For evaluating both the applicability and the utility of the proposed technique, we perform a large-scale measurement campaign targeting – from multiple vantage points – more than 327K destinations belonging to about 14K ASes. The results show how TP addresses are very common and affect about 17% of AS-level links extracted from traceroute traces. Compared to a previously proposed heuristic method, our technique allows to identify many more TP addresses and to re-interpret part of its results.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save

Springer+ Basic
EUR 32.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
USD 54.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 72.00
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Similar content being viewed by others


  1. The CAIDA AS Relationships Dataset (June 2012),

  2. IP Address Hitlist, PREDICT ID USC-LANDER internet- address- hitlist- it47w-20120427, 2010-03-29 to 2012-05-30, .

  3. Augustin, B., Cuvellier, X., Orgogozo, B., Viger, F., Friedman, T., Latapy, M., Magnien, C., Teixeira, R.: Avoiding traceroute anomalies with paris traceroute. In: Proc. ACM SIGCOMM IMC (2006)

    Google Scholar 

  4. Augustin, B., Krishnamurthy, B., Willinger, W.: IXPs: mapped? In: ACM SIGCOMM IMC (2009)

    Google Scholar 

  5. Baker, F.: IETF RFC1812: Requirements for IP version 4 routers

    Google Scholar 

  6. Bavier, A., Bowman, M., Chun, B., Culler, D., Karlin, S., Muir, S., Peterson, L., Roscoe, T., Spalink, T., Wawrzoniak, M.: Operating system support for planetary-scale network services. In: NSDI (2004)

    Google Scholar 

  7. Botta, A., de Donato, W., Pescapè, A., Ventre, G.: Discovering topologies at router level: Part ii. In: GLOBECOM, pp. 2696–2701 (2007)

    Google Scholar 

  8. Chen, K., Choffnes, D., Potharaju, R., Chen, Y., Bustamante, F., Pei, D., Zhao, Y.: Where the sidewalk ends. In: Proc. ACM CoNEXT (2009)

    Google Scholar 

  9. Cymru, T.: IP to ASN mapping (2012),

  10. de Donato, W., Marchetta, P., Pescapé, A.: A Hands-on Look at Active Probing Using the IP Prespecified Timestamp Option. In: Taft, N., Ricciato, F. (eds.) PAM 2012. LNCS, vol. 7192, pp. 189–199. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  11. Donnet, B., Friedman, T.: Internet topology discovery: a survey. IEEE Communications Surveys and Tutorials (2007)

    Google Scholar 

  12. Gregori, E., Improta, A., Lenzini, L., Rossi, L., Sani, L.: On the incompleteness of the AS-level graph: a novel methodology for BGP route collector placement. In: Proc. ACM SIGCOMM IMC (2012)

    Google Scholar 

  13. He, Y., Siganos, G., Faloutsos, M., Krishnamurthy, S.: Lord of the links: a framework for discovering missing links in the internet topology. IEEE/ACM Transactions on Networking (2009)

    Google Scholar 

  14. Hyun, Y., Broido, A., Claffy, K.C.: On third-party addresses in traceroute paths. In: Proc. PAM (2003)

    Google Scholar 

  15. Hyun, Y., Broido, A., Claffy, K.C.: Traceroute and BGP AS path incongruities. Technical report, CAIDA (2003)

    Google Scholar 

  16. Katz-Bassett, E., Madhyastha, H.V., Adhikari, V.K., Scott, C., Sherry, J., van Wesep, P., Anderson, T.E., Krishnamurthy, A.: Reverse traceroute. In: Proc. NSDI (2010)

    Google Scholar 

  17. Luckie, M., Dhamdhere, A., Murrell, D., et al.: Measured impact of crooked traceroute. ACM SIGCOMM Computer Communication Review (2011)

    Google Scholar 

  18. Marchetta, P., de Donato, W., Pescapé, A.: Detecting third-party addresses in traceroute ip paths. In: Proc. ACM SIGCOMM (2012)

    Google Scholar 

  19. Marchetta, P., Mérindol, P., Donnet, B., Pescapè, A., Pansiot, J.-J.: Topology discovery at the router level: A new hybrid tool targeting isp networks. IEEE JSAC (2011)

    Google Scholar 

  20. Marchetta, P., Mérindol, P., Donnet, B., Pescapé, A., Pansiot, J.J.: Quantifying and Mitigating IGMP Filtering in Topology Discovery. In: Proc. IEEE GLOBECOM (2012)

    Google Scholar 

  21. Packet Clearing House. IXP directory,

  22. PeeringDB. Exchange points list,

  23. Postel, J.: Internet Protocol. RFC 791 (Standard) (September 1981)

    Google Scholar 

  24. Sherry, J., Katz-Bassett, E., Pimenova, M., Madhyastha, H.V., Anderson, T., Krishnamurthy, A.: Resolving ip aliases with prespecified timestamps. In: IMC 2010, pp. 172–178. ACM, New York (2010)

    Google Scholar 

  25. Tozal, M., Sarac, K.: Palmtree: An ip alias resolution algorithm with linear probing complexity. Computer Communications (2010)

    Google Scholar 

  26. Tozal, M., Sarac, K.: Tracenet: an internet topology data collector. In: Proc. ACM SIGCOMM IMC (2010)

    Google Scholar 

  27. Zhang, Y., Oliveira, R., Wang, Y., Su, S., Zhang, B., Bi, J., Zhang, H., Zhang, L.: A framework to quantify the pitfalls of using traceroute in as-level topology measurement. IEEE JSAC (2011)

    Google Scholar 

Download references

Author information

Authors and Affiliations


Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2013 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Marchetta, P., de Donato, W., Pescapé, A. (2013). Detecting Third-Party Addresses in Traceroute Traces with IP Timestamp Option. In: Roughan, M., Chang, R. (eds) Passive and Active Measurement. PAM 2013. Lecture Notes in Computer Science, vol 7799. Springer, Berlin, Heidelberg.

Download citation

  • DOI:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-36515-7

  • Online ISBN: 978-3-642-36516-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics