Happy 10 Years to the IPv6 Hitlist

Ten years ago, I, along with colleagues, started the IPv6 Hitlist to better understand the scale of active IPv6 address adoption. However, the sheer size of the potential address space made traditional scanning approaches for IPv4 impractical. (It’s roughly 10²⁹ times larger than IPv4!)

We needed a more efficient way to identify useful measurement targets.

What began as a research project in 2016 has since become a resource used by researchers and internet measurement organizations around the world.

To celebrate its tenth anniversary, my colleagues Lion Steger, Patrick Sattler, Johannes Zirngibl, and I published IPv6 Hitlist Service: Lessons Learned From 10 Years of Operation, looking back at how the service has evolved, how researchers use it, and what we've learned from keeping it running.

A Decade of IPv6 Measurement

The IPv6 Hitlist collects addresses from multiple sources, then tests their responsiveness and makes the resulting datasets available for research.

A lot has changed since we began:

• The service now contains 60 times as many addresses as it did initially, including ten times as many responsive addresses. 
• Since the public service launched in 2018, more than 150 researchers have registered.
• The work has been cited in over 240 publications.

We also wanted to understand how well the hitlist represents the IPv6 internet today.

By comparing our data against three months of real-world traffic from a major European ISP and Tier-1 network, we found that the hitlist contains at least one address from 87.1% of ASes. 56.5% of /48 prefixes observed generating IPv6 traffic. Those prefixes accounted for 97.2% of the observed traffic volume.

These results are encouraging, but they also illustrate why understanding a dataset's coverage matters. A hitlist can represent a large share of internet traffic while still missing parts of the address space, particularly when looking only at addresses that respond to specific probes.

What We’ve Learned

One of the most important lessons is that maintaining a measurement service requires continuous adaptation. Over the years, we've added new address sources, introduced new probing methods, improved our filtering, and adjusted the service as IPv6 networks changed. 

We've also learned that more addresses don't automatically mean better measurements. How those addresses are collected, which protocols they respond to, and how researchers interpret the results all matter.

Further, it’s important to handle aliased prefixes carefully. Excluding them entirely can remove significant parts of the internet from a study, while including them indiscriminately can distort results.

One lesson we’ve also applied at IPinfo is the value of making measurement data continuously available. A service maintained over years helps researchers understand how that internet changes.

I'm grateful to the researchers who have contributed to the service over the years, and to the community that continues to use it.

Read the full paper: IPv6 Hitlist Service: Lessons Learned From 10 Years of Operation