Understanding Passive and Active Service Discovery. Bartlett, G., Heidemann, J., & Papadopoulos, C. In Proceedings of the ACM Internet Measurement Conference, pages to appear, San Diego, California, USA, October, 2007. ACM. ![Understanding Passive and Active Service Discovery [link]](https://bibbase.org/img/filetypes/link.svg "link")
Paper abstract bibtex Increasingly, network operators do not directly operate computers on their network, yet are responsible for assessing network vulnerabilities to ensure compliance with laws and policies about information disclosure, and tracking services that affect provisioning. Thus, with decentralized network management, \emphservice discovery becomes an important part of maintaining and protecting computer networks. We explore two approaches to service discovery: \emphactive probing and \emphpassive monitoring. Active probing finds all services currently on the network, except services temporarily unavailable or hidden by firewalls; however, it is often too invasive, especially if used across administrative boundaries. Passive monitoring is typically much slower and can find transient services, but misses services that are idle. We compare the accuracy of passive and active approaches to service discovery and show that they are complimentary, highlighting the need for multiple active scans coupled with long-duration passive monitoring. We find passive monitoring is well suited for quickly finding popular services, finding servers responsible for 99% of incoming connections within minutes. Active scanning is better suited to rapidly finding \emphall servers, which is important for vulnerability detection–one scan finds 98% of services in two hours, missing only a handful. External scans are an unexpected ally to passive monitoring, speeding service discovery by the equivalent of 9–15 days of additional observation. Finally, we show how the use of static or dynamic addresses changes the effectiveness of service discovery, both due to address reuse and VPN effects.
@InProceedings{Bartlett07d,
author = "Genevieve Bartlett and John Heidemann and Christos Papadopoulos",
title = "Understanding Passive and Active Service
Discovery",
booktitle = "Proceedings of the " # "ACM Internet Measurement Conference",
year = 2007,
sortdate = "2007-10-01",
publisher = "ACM",
address = "San Diego, California, USA",
month = oct,
pages = "to appear",
jlocation = "johnh: pafile",
keywords = "passive service discovery, active service discovery",
project = "ant, lander, predict",
jsubject = "traffic_detection",
url = "https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07d.html",
pdfurl = "https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07d.pdf",
myorganization = "USC/Information Sciences Institute",
copyrightholder = "ACM",
copyrightterms = "Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. ",
abstract = "
Increasingly, network operators do not directly operate computers on
their network, yet are responsible for assessing network
vulnerabilities to ensure compliance with laws and policies about
information disclosure, and tracking services that affect
provisioning. Thus, with decentralized network management,
\emph{service discovery} becomes an important part of maintaining and
protecting computer networks. We explore two approaches to service
discovery: \emph{active probing} and \emph{passive monitoring}.
Active probing finds all services currently on the network, except
services temporarily unavailable or hidden by firewalls; however, it
is often too invasive, especially if used across administrative
boundaries. Passive monitoring is typically much slower and can find
transient services, but misses services that are idle. We compare the
accuracy of passive and active approaches to service discovery and
show that they are complimentary, highlighting the need for multiple
active scans coupled with long-duration passive monitoring. We find
passive monitoring is well suited for quickly finding popular
services, finding servers responsible for 99\% of incoming connections
within minutes. Active scanning is better suited to rapidly finding
\emph{all} servers, which is important for vulnerability
detection--one scan finds 98\% of services in two hours, missing only
a handful. External scans are an unexpected ally to passive
monitoring, speeding service discovery by the equivalent of 9--15 days
of additional observation. Finally, we show how the use of static or
dynamic addresses changes the effectiveness of service discovery, both
due to address reuse and VPN effects.
",
}
Downloads: 0
{"_id":"Y5HLC8JKaDgtP8fro","bibbaseid":"bartlett-heidemann-papadopoulos-understandingpassiveandactiveservicediscovery-2007","author_short":["Bartlett, G.","Heidemann, J.","Papadopoulos, C."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","author":[{"firstnames":["Genevieve"],"propositions":[],"lastnames":["Bartlett"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]},{"firstnames":["Christos"],"propositions":[],"lastnames":["Papadopoulos"],"suffixes":[]}],"title":"Understanding Passive and Active Service Discovery","booktitle":"Proceedings of the ACM Internet Measurement Conference","year":"2007","sortdate":"2007-10-01","publisher":"ACM","address":"San Diego, California, USA","month":"October","pages":"to appear","jlocation":"johnh: pafile","keywords":"passive service discovery, active service discovery","project":"ant, lander, predict","jsubject":"traffic_detection","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07d.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07d.pdf","myorganization":"USC/Information Sciences Institute","copyrightholder":"ACM","copyrightterms":"Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. ","abstract":"Increasingly, network operators do not directly operate computers on their network, yet are responsible for assessing network vulnerabilities to ensure compliance with laws and policies about information disclosure, and tracking services that affect provisioning. Thus, with decentralized network management, \\emphservice discovery becomes an important part of maintaining and protecting computer networks. We explore two approaches to service discovery: \\emphactive probing and \\emphpassive monitoring. Active probing finds all services currently on the network, except services temporarily unavailable or hidden by firewalls; however, it is often too invasive, especially if used across administrative boundaries. Passive monitoring is typically much slower and can find transient services, but misses services that are idle. We compare the accuracy of passive and active approaches to service discovery and show that they are complimentary, highlighting the need for multiple active scans coupled with long-duration passive monitoring. We find passive monitoring is well suited for quickly finding popular services, finding servers responsible for 99% of incoming connections within minutes. Active scanning is better suited to rapidly finding \\emphall servers, which is important for vulnerability detection–one scan finds 98% of services in two hours, missing only a handful. External scans are an unexpected ally to passive monitoring, speeding service discovery by the equivalent of 9–15 days of additional observation. Finally, we show how the use of static or dynamic addresses changes the effectiveness of service discovery, both due to address reuse and VPN effects. ","bibtex":"@InProceedings{Bartlett07d,\n\tauthor = \t\"Genevieve Bartlett and John Heidemann and Christos Papadopoulos\",\n\ttitle = \t\"Understanding Passive and Active Service\n Discovery\",\n\tbooktitle = \t\"Proceedings of the \" # \"ACM Internet Measurement Conference\",\n\tyear = \t\t2007,\n\tsortdate = \t\t\"2007-10-01\", \n\tpublisher =\t\"ACM\",\n\taddress =\t\"San Diego, California, USA\",\n\tmonth =\t\toct,\n\tpages =\t\t\"to appear\",\n\tjlocation =\t\"johnh: pafile\",\n\tkeywords =\t\"passive service discovery, active service discovery\",\n\tproject = \"ant, lander, predict\",\n\tjsubject = \"traffic_detection\",\n\turl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07d.html\",\n\tpdfurl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07d.pdf\",\n\tmyorganization =\t\"USC/Information Sciences Institute\",\n\tcopyrightholder = \"ACM\",\n\tcopyrightterms = \"Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. \",\n\tabstract = \"\nIncreasingly, network operators do not directly operate computers on\ntheir network, yet are responsible for assessing network\nvulnerabilities to ensure compliance with laws and policies about\ninformation disclosure, and tracking services that affect\nprovisioning. Thus, with decentralized network management,\n\\emph{service discovery} becomes an important part of maintaining and\nprotecting computer networks. We explore two approaches to service\ndiscovery: \\emph{active probing} and \\emph{passive monitoring}.\nActive probing finds all services currently on the network, except\nservices temporarily unavailable or hidden by firewalls; however, it\nis often too invasive, especially if used across administrative\nboundaries. Passive monitoring is typically much slower and can find\ntransient services, but misses services that are idle. We compare the\naccuracy of passive and active approaches to service discovery and\nshow that they are complimentary, highlighting the need for multiple\nactive scans coupled with long-duration passive monitoring. We find\npassive monitoring is well suited for quickly finding popular\nservices, finding servers responsible for 99\\% of incoming connections\nwithin minutes. Active scanning is better suited to rapidly finding\n\\emph{all} servers, which is important for vulnerability\ndetection--one scan finds 98\\% of services in two hours, missing only\na handful. External scans are an unexpected ally to passive\nmonitoring, speeding service discovery by the equivalent of 9--15 days\nof additional observation. Finally, we show how the use of static or\ndynamic addresses changes the effectiveness of service discovery, both\ndue to address reuse and VPN effects.\n\",\n}\n\n","author_short":["Bartlett, G.","Heidemann, J.","Papadopoulos, C."],"bibbaseid":"bartlett-heidemann-papadopoulos-understandingpassiveandactiveservicediscovery-2007","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett07d.html"},"keyword":["passive service discovery","active service discovery"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["DTXTQhi8vCYSmtrPK","YLyu3mj3xsBeoqiHK","fLZcDgNSoSuatv6aX","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["passive service discovery","active service discovery"],"search_terms":["understanding","passive","active","service","discovery","bartlett","heidemann","papadopoulos"],"title":"Understanding Passive and Active Service Discovery","year":2007}