sc_ally1

Usage

Overview

The sc_ally utility provides the ability to connect to a running scamper(1) instance and have a set of IPv4 address sets tested for aliases using the Ally technique. For each address pair on a single line in the file, sc_ally establishes which probe methods (UDP, TCP-ack, ICMP-echo) solicit an incrementing IP-ID value, and then uses the Ally technique on pairs where a probe method is able to obtain an incrementing IP-ID for both addresses. sc_ally can also infer which IP addresses are aliases using the Mercator common source address technique as a byproduct of the UDP probing that sc_ally does. The output of sc_ally is written to a warts(5) file, which can then be processed to extract aliases. The options are as follows:

-?

prints a list of command line options and a synopsis of each.

-D

causes sc_ally to detach and become a daemon.

-a infile

specifies the name of the input file which consists of a sequence of IPv4 addresses, one candidate set per line.

-o outfile

specifies the name of the output file to be written. The output file will use the warts format.

-p port

specifies the port on the local host where scamper(1) is accepting control socket connections.

-U unix-socket

specifies the name of a unix domain socket where scamper(1) is accepting control socket connections.

-d dump-id

specifies the number identifying an analysis to conduct. The current choices for are 1-3, and are:

• 1: dump aliases inferred using the Ally (IPID-based) technique.

• 2: dump aliases inferred using the Mercator (common source address based) technique.

• 3: dump aliases inferred using both Ally and Mercator techniques.

-f fudge

specifies the fudge factor to use when (1) inferring if IPIDs are assigned from a counter, and (2) inferring if two addresses share the same counter. A value of zero will cause ally to infer aliases if the IPIDs are in a monotonic sequence.

-i probe-wait

specifies the inter-probe gap for both ping and Ally measurements, in milliseconds. The default is 1000ms (1 second); the minimum is 200ms, and the maximum is 2000ms.

-O options

allows the behavior of sc_ally to be further tailored. The current choices for this option are:

• nobs: do not consider byte swapped IPID values when inferring if IPID values are assigned from a counter.

• tc: dump transitive closure when reporting aliases.

-q attempts

specifies the number of probes to use with Ally.

-t logfile

specifies the name of a file to log output from sc_ally generated at run time.

-w waittime

specifies the minimum length of time, in seconds, to wait between completing a measurement to a particular IP address and issuing the next.

Examples

Given a set of IPv4-address sets in a file named infile.txt:

192.0.2.1 192.0.32.10 192.0.31.60
192.0.2.2 192.0.31.8
192.0.2.3 192.0.30.64

and a scamper(1) daemon listening on port 31337, then these addresses can be tested for aliases using

sc_ally -a infile.txt -o outfile.warts -p 31337

To obtain a list of inferred alias pairs using the Ally technique from a warts(5) file:

sc_ally -d 1 outfile.warts

To obtain a list of inferred routers using a transitive closure of alias pairs inferred using the Ally and Mercator techniques:

sc_ally -d 3 -O tc outfile.warts