johnh: research teaching PAPERS software other contact about

Understanding Passive and Active Service Discovery (extended)

Genevieve Bartlett, John Heidemann, and Christos Papadopoulos
USC/Information Sciences Institute

Abstract

Increasingly, network operators do not directly operate computers on their network, yet are responsible for assessing network vulnerabilities to ensure compliance with laws and policies about information disclosure, and tracking services that affect provisioning. Thus, with decentralized network management, service discovery becomes an important part of maintaining and protecting computer networks. We explore two approaches to service discovery: active probing and \emphpassive monitoring. Active probing finds all services currently on the network, except services temporarily unavailable or hidden by firewalls; however, it is often too invasive, especially if used across administrative boundaries. Passive monitoring is typically much slower and can find transient services, but misses services that are idle. We compare the accuracy of passive and active approaches to service discovery and show that they are complimentary, highlighting the need for multiple active scans coupled with long-duration passive monitoring. We find passive monitoring is well suited for quickly finding popular services, finding servers responsible for 99% of incoming connections within minutes. Active scanning is better suited to rapidly finding all servers, which is important for vulnerability detection-one scan finds 98% of services in two hours, missing only a handful. External scans are an unexpected ally to passive monitoring, speeding service discovery by the equivalent of 9-15 days of additional observation. Finally, we show how the use of static or dynamic addresses changes the effectiveness of service discovery, both due to address reuse and VPN effects.

Availability

This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below.

Reference

Bartlett07b: Genevieve Bartlett, John Heidemann, and Christos Papadopoulos. Understanding Passive and Active Service Discovery (extended). Technical Report ISI-TR-2007-642, USC/Information Sciences Institute, May, 2007. To appear, ACM Internet Measurement Conference 2007. <http://www.isi.edu/~johnh/PAPERS/Bartlett07b.html>.

@techreport{Bartlett07b,
	author = "Genevieve Bartlett and John Heidemann and Christos Papadopoulos",
	title = "Understanding Passive and Active Service
                         Discovery  (extended)",
	institution = "USC/Information Sciences Institute",
	year = "2007",
	number = "ISI-TR-2007-642",
	note = "To appear, ACM Internet Measurement Conference 2007",
	month = "May",
	keywords = "passive service discovery, active service discovery",
	url = "http://www.isi.edu/~johnh/PAPERS/Bartlett07b.html",
	pdfurl = "http://www.isi.edu/~johnh/PAPERS/Bartlett07b.pdf",
	myorganization = "USC/Information Sciences Institute",
	copyrightholder = "authors",
}

Copyright

This paper is copyright © 2007 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted.

To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.