Motu Dealiasing Tool

Motu is a tool for dealiasing pairs of IPv4 addresses. It is based on the IP Prespecified Timestamp dealiasing method described in "Resolving IP Aliases with Prespecified Timestamps", Sherry et al., IMC'10

Algorithm

While the Motu dealiasing algorithm is based on the description provided by Sherry et al. we have made several modifications and enhancements based on investigations of how routers behave when the prespecified timestamp option is included in packets directed to them. For more information about the details of this work, see our TSPS Investigation summary. These modifications include: a suite of heuristics for detecting cases where one address is on the reverse path from the other; detecting an abnormal timestamping pattern; and increasing the specificity of the overall verdicts that the algorithm produces.

The reverse path heuristics allow pairs of addresses which would have been classified as unknown under the original algorithm to be declared as non-aliases. We have used these checks to find false-positives in alias sets found by the iffinder tool. The tool also recovers pairs which would have been classified as non-aliases due to an unusual stamping pattern where midnight offset and epoch stamps are used adjacent to each other. The biggest point of difference with this implementation of the algorithm however, is the refined overall classifications. Sherry's implementation only had three possible results for a pair - unknown, alias and non-alias. Because of our investigations into the causes for stamping behaviors, we are able to give different confidence levels to our classifications such as strong and weak aliases. We are also more rigorous when we classify the stamping behavior exhibited by an address, for example, we are careful to ensure that an address has consistent stamping behavior across multiple probes.

Implementation

Motu automates the entire process of dealiasing a pair of candidate addresses. It connects to an mper probing engine to adaptively probe the candidates based on observed behaviors.

Motu is designed to allow the dealiasing of large quantities of pairs of candidate addresses. It can be used in ad-hoc mode with a pair supplied on the command line, but if it is passed a file containing a list of pairs, they will be probed in parallel (up to a user-specified limit). In addition to parallelized probing, Motu can operate in "Suitability Only" mode which allows single addresses to be probed to determine their stamping behavior. This combined with the "Educated Probing" mode, can be used to more intelligently pair candidate addresses to increase the chances of successful dealiasing. For more information, see the Motu readme