Internet Mapping Efforts

	Providing Advanced High Tech Security Solutions			Cyanline Founder Steven Branigan authored the book that takes forensic investigators and law enforcement officials through high-tech investigations. It provides best-practices on handling digital information
Experts in High Tech Crime Prevention, Detection, Investigation & Litigation Support

Internet Connectivity Research

Research into the connectivity of the Internet has been going on for quite a few years. The topic is made very interesting by the fact that no one central authority controls Internet routing or connectivity. Thus, the Internet grows through cooperative means not through permisson or control of a central authority.
Mapping connectivity of the Internet requires network connectivity data collection. Traditionally, this has been done using ping-like packets with low Time To Live (TTL) field values which are increased. The low TTL value generally results in a ping packet "expiring" before it reaches its destination. When a packet's TTL reaches zero, the router processing the packet may generate a ICMP packet reporting the TTL expiration and send it back to the ping packet originator. Included in the ICMP packet is "a" source address of the router that detected the TTL expiration. (This is a well known technique that is used for the traceroute tool.)
While this is an exciting way to check the connectivity of the Internet, is has a few issues.

In order to work, it relies on routers actually responding to TTL expiration with an ICMP error message. This does not always happen.
It is an active method of data collection. In other words, network connectivity mapping using the traceroute technique requires that packets be sent all over the Internet. It is possible that network administrators might block the incoming packets and effectively block the network connectivity mapping efforts.
Point of view matters. A system mapping the Internet from the AT&T network will see a different connectivity map than system mapping the network from a Comcast network.
The Internet is just too large to map using a traceroute style of mapping.

Potential solution

To address some of these network mapping issues, CyanLine has performed research into mapping the Internet using BGP feeds and BGP connectivity. (Using data collected by the Oregon Routeviews project and processed by CAIDA.) While we are working on a paper to detail the findings, we have been excited by the results to date. We are releasing the images that we have made from the BGP data and look forward to your comments.

Sites of Interest for other Internet Connectivity Research

Large Graph Layout

The Oregon Routeviews Project

Lumeta - Commercialization of network mapping

Think something more should be up here?: contact steve branigan today.

CyanLine Blog

Why won’t my call go through? Denial of service in the cell phone network.

Mon, 30 Jan 2012 19:50:02 +0000 - Recently, some of the major cellular carriers have released “Network Extenders”, also known as femtocell. The network extender is a device that a subscriber purchases to extend the reach of the cell phone network. (In effect, the subscriber is paying for the privilege of increasing the cellular network coverage. What a deal!) The network extender [...]

SCADA and security

Wed, 30 Nov 2011 13:49:10 +0000 - A recent article by Hal Hodson of Information Age reports that the FBI has publicly stated that hackers have successfully targeted SCADA systems in three unnamed US communities. The attacks were reported to have the potential to shut down electricity at a nearby mall as well as the potential to dump sewage. Just weeks earlier came an announcement from the [...]

How to find hidden passwords (and how to protect them)

Fri, 30 Sep 2011 15:27:46 +0000 - While preparing to teach a computer forensic workshop, I discovered a new live Linux distribution entitled C.A.IN.E, (Computer Aided Investigative Environment.) This software is one of a few live Linux distributions that allows a user to boot Linux from a CD or DVD and start a forensic investigation. The distribution includes tools to make forensic [...]

Revenge Hacking

Mon, 01 Aug 2011 03:26:15 +0000 - Revenge is a powerful motivator for hacking. Take, for example, the case of Barry Ardolf of Minnesota. Trouble started when Mr. Ardolf was accused by a neighbor of kissing their 4-year boy on the lips. When the parents confronted Mr. Ardolf, he confessed that the accusation was true. Naturally, the parents of the 4-year old contacted the police. This made Mr. Ardolf angry [...]