Verfploeter: Active Measurement of Anycast Catchements


Verfploeter consists of:

  • a pinger that sends probes to target networks
  • packetcapr that records replies at each anycast site
  • (as an alternative to packetcapr, one can just run tcpdump; we use tcpdump -s 0 -n -i eth0 -w file.pcap icmp and host TARGETIP )
  • pingextract that pulls data out of the ping replies

Verfploeter is written by Wouter de Vries at University of Twente, and is described in the papers:


  • Wouter B. de Vries, Ricardo de O. Schmidt, Wes Hardaker, John Heidemann, Pieter-Tjerk de Boer and Aiko Pras 2017. Verfploeter: Broad and Load-Aware Anycast Mapping. Proceedings of the ACM Internet Measurement Conference (London, UK, 2017), 477–488. [DOI] [PDF] [Dataset] Details

Running Verfploeter

On the probing side:

  1. get an IP hitlist. We recommend the most recent one (see all our datasets and instructions to get them).
  2. start capture at each site
  3. run pinger, feeding it the hitlist on stdin. Specify an integer measurement identifier with the -i switch (e.g. -i 4242).

On the capture side:

  1. run packetcapr or tcpdump

At the central site, with packetcapr:

  1. run packetcapr --server

Or on the central site, manually:

  1. copy the tcpdump files locally
  2. extract the data with pingextract --identifier SITENAME --sequence NUMBER INPUTFILE > OUTPUTFILE where NUMBER is the same number you passed to pinger above (4242 in the example). pingextract is distributed with packetcapr source code)

  3. copy each site’s tcpdump files locally
  4. extract the data with pingextract using the same measurement identifier from above with the -i switch (e.g. -i 4242). This will produce a CSV file of addresses seen at the site to further process.


Sample hitlists to drive Verfploter are available; see our hitlist webpage.