What an Internet-Wide Scan Can Actually Tell Us
The Internet-wide scans in the open-tunnelling-host study answer a narrower question than “how many networks can be compromised?” They look for public endpoints whose responses match behaviors associated with NAT translation, two-way proxying, or GRETAP broadcast forwarding. The focus here is how those observations become evidence, where the reported scale comes from, and what remains unproven about any particular host. That distinction gives readers a sound basis for prioritizing defenses without turning a scan signal into a diagnosis.
A scan is not a remote version of the controlled attack experiments. An experiment can arrange a known topology, a private client, a configured NAT, or a bridge and then test whether a particular sequence succeeds. An Internet-wide measurement has to be less intrusive. It sends a probe, records a reply or address relationship, and infers that the responding host may have a property relevant to the research. The value lies in measuring an exposure signal at scale while preserving the boundary between observation and exploitability.
What the nine scans were designed to observe
The authors conducted nine Internet-wide scans in total. Six were NAT scans: three used GRE and three used IPIP, each testing a different private source address. One scan looked for GRETAP hosts that forward broadcast traffic. Two scans looked for two-way proxies, one using GRE and one using IPIP. The categories reflect different capabilities from the earlier mechanisms, not nine repetitions of one test.
The six NAT scans asked whether an open tunnel host would decapsulate traffic with a private inner source and translate it before forwarding. The researchers used representative addresses from private ranges rather than attempting the complete, intrusive traffic-injection sequence against every address on the Internet. A response could indicate that a host performs the kind of translation relevant to the private-network attack. It could not, by itself, prove that a live client exists at every possible private address or that a later TCP connection would succeed.
The two-way-proxy scans needed a different design because reply delivery was the property being measured. The paper uses two scanners under the researchers’ control. One sends a probe containing an inner relationship between the scanners; the other listens for a response that reveals whether the probed host translated and forwarded the traffic in the required way. This separates a host that simply reflects or forwards a packet from a host whose translation state plausibly creates a return path.
The GRETAP scan was deliberately changed to avoid the most intrusive signal. A probe that directly elicited the host’s ARP response could reveal private and public hardware addresses, so the authors did not use it on uninvolved hosts. Instead, they sent a broadcast Ethernet and ICMP probe and looked for responses that indicated an open GRETAP endpoint forwarding broadcast frames. That is a safer indicator of Layer 2 behavior, but it is also less conclusive about the full MAC-leak and re-encapsulation attacks.
The researchers first ran a one-percent scan. They continued to a full Internet-wide scan when the preliminary scan produced results, and they stopped when it did not.