Explainable Rule Mining of IPv6 Extension-Header Presence Patterns from Paired-Vantage Captures
IPv6 Fragment extension-header rules from JAMES captures reflect within-packet co-occurrence, not temporal dynamics.
The paper tests whether an explainable temporal-logic miner can recover human-readable rules of IPv6 extension-header behavior from the JAMES paired-vantage captures. A negative-control protocol shows the dominant Fragment-EH rule is a within-packet, near-definitional co-occurrence rather than a cross-packet temporal pattern. Decision-tree and large-language-model baselines corroborate that finding, while a synthetic positive control validates when genuine temporal structure would be detected. A sender-conditioned retention measurement independently recovers the expected within-window ordering of extension-header observability.
- Dominant Fragment-EH rule is within-packet co-occurrence, not temporal.
- Negative-control protocol separates cross-packet dynamics from co-occurrence.
- Decision-tree and LLM baselines corroborate the negative finding.
- Synthetic positive control shows when real temporal dependency is detectable.
From the original article
1 min read at arxiv.orgIPv6 extension headers (EHs), such as fragmentation, segment routing, and in-situ telemetry, are operationally important yetwidely dropped in transit, and characterising their behaviour from packet captures is a recurring measurement problem.
By Priyanka Sinha · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.