{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2016:6DWXI7KT624ZO7JHBFRD26QT7R","short_pith_number":"pith:6DWXI7KT","schema_version":"1.0","canonical_sha256":"f0ed747d53f6b9977d2709623d7a13fc557ffcc5e9be13b8e08b222a180defb5","source":{"kind":"arxiv","id":"1606.07613","version":1},"attestation_state":"computed","paper":{"title":"Carrier-Grade Anomaly Detection Using Time-to-Live Header Information","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.NI","authors_text":"Georg Carle, Oliver Gasser, Paul Emmerich, Quirin Scheitle","submitted_at":"2016-06-24T09:17:49Z","abstract_excerpt":"Time-to-Live data in the IP header offers two interesting characteristics: First, different IP stacks pick different start TTL values. Second, each traversed router should decrement the TTL value. The combination of both offers host and route fingerprinting options. We present the first work to investigate Internet-wide TTL behavior at carrier scale and evaluate its fit to detect anomalies, predominantly spoofed source IP addresses. Using purpose-built software, we capture 2 weeks of raw TTL data at a 40 Gbit/s Internet uplink. For further insight, we actively measure observed hosts and conduc"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"1606.07613","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.NI","submitted_at":"2016-06-24T09:17:49Z","cross_cats_sorted":[],"title_canon_sha256":"149f27b8b1bc9e0db48396d3fe1d23368cb577a4427d80479e1307e71c2e18f5","abstract_canon_sha256":"ae0ec746f490496c8b8d6e69c56b034c9fdc688494ab5886d2eed7916c9d34e4"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T01:11:57.126670Z","signature_b64":"+C2mqC25AvsA8oVjNg8I53AROetkOXtBd1MuTBlhL73XM8LWzu6Ga2nf42y/3bxiq1YefZpefoOYhqdDfuqaCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"f0ed747d53f6b9977d2709623d7a13fc557ffcc5e9be13b8e08b222a180defb5","last_reissued_at":"2026-05-18T01:11:57.126329Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T01:11:57.126329Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Carrier-Grade Anomaly Detection Using Time-to-Live Header Information","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.NI","authors_text":"Georg Carle, Oliver Gasser, Paul Emmerich, Quirin Scheitle","submitted_at":"2016-06-24T09:17:49Z","abstract_excerpt":"Time-to-Live data in the IP header offers two interesting characteristics: First, different IP stacks pick different start TTL values. Second, each traversed router should decrement the TTL value. The combination of both offers host and route fingerprinting options. We present the first work to investigate Internet-wide TTL behavior at carrier scale and evaluate its fit to detect anomalies, predominantly spoofed source IP addresses. Using purpose-built software, we capture 2 weeks of raw TTL data at a 40 Gbit/s Internet uplink. For further insight, we actively measure observed hosts and conduc"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1606.07613","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"1606.07613","created_at":"2026-05-18T01:11:57.126386+00:00"},{"alias_kind":"arxiv_version","alias_value":"1606.07613v1","created_at":"2026-05-18T01:11:57.126386+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1606.07613","created_at":"2026-05-18T01:11:57.126386+00:00"},{"alias_kind":"pith_short_12","alias_value":"6DWXI7KT624Z","created_at":"2026-05-18T12:30:01.593930+00:00"},{"alias_kind":"pith_short_16","alias_value":"6DWXI7KT624ZO7JH","created_at":"2026-05-18T12:30:01.593930+00:00"},{"alias_kind":"pith_short_8","alias_value":"6DWXI7KT","created_at":"2026-05-18T12:30:01.593930+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R","json":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R.json","graph_json":"https://pith.science/api/pith-number/6DWXI7KT624ZO7JHBFRD26QT7R/graph.json","events_json":"https://pith.science/api/pith-number/6DWXI7KT624ZO7JHBFRD26QT7R/events.json","paper":"https://pith.science/paper/6DWXI7KT"},"agent_actions":{"view_html":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R","download_json":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R.json","view_paper":"https://pith.science/paper/6DWXI7KT","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=1606.07613&json=true","fetch_graph":"https://pith.science/api/pith-number/6DWXI7KT624ZO7JHBFRD26QT7R/graph.json","fetch_events":"https://pith.science/api/pith-number/6DWXI7KT624ZO7JHBFRD26QT7R/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R/action/timestamp_anchor","attest_storage":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R/action/storage_attestation","attest_author":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R/action/author_attestation","sign_citation":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R/action/citation_signature","submit_replication":"https://pith.science/pith/6DWXI7KT624ZO7JHBFRD26QT7R/action/replication_record"}},"created_at":"2026-05-18T01:11:57.126386+00:00","updated_at":"2026-05-18T01:11:57.126386+00:00"}