TNet: Efficient IPv6 Active Network Discovery

Jiatang Zhao

doi:10.1016/j.comnet.2026.112170

TNet: Efficient IPv6 Active Network Discovery

2026-02-27

0

PRE

AI

DOI：10.1016/j.comnet.2026.112170

Original

Original request for help

Save

Abstract

En 中文

Due to mechanisms such as prefix rotation, using target generation algorithms for IPv6 address-level scanning will face the dilemma of IP churn. Since responsive IPv6 hosts only exist within active networks, efficiently identifying IPv6 active networks at a global scale is more useful for IPv6 scanning and security analysis. However, brute-force scanning for this purpose is infeasible due to the vast IPv6 address space. To this end, we propose TNet, a novel asynchronous scanner based on reinforcement learning, specifically designed to discover IPv6 active networks. TNet uses heuristic methods to extract candidate /48 regions from global BGP prefixes and employs a multi-level budget allocation (MBA) algorithm for dynamic probing. In real-world tests, TNet discovered over 8 million active networks within just a few hours, achieving a 6.8 ×  improvement over state-of-the-art methods. Furthermore, our study proposes a four-level security analysis framework targeting IPv6 gateway devices. We reveal a specific information leakage risk, identifying 713 leaked MAC addresses across 213 active networks, which led to the discovery of 109 exposed internal network devices.

Keywords:

IPv6 active network discovery

reinforcement learning

asynchronous scanning

multi-level budget allocation

network security analysis

TNet: Efficient IPv6 Active Network Discovery

Abstract

Journal

Organization