Discovering IPv6 CIDR Ranges Through Bit Entropy Analysis

2025-09-26 • #go, #networking, #ipv6, #cidr

Discovering IPv6 CIDR Ranges Through Bit Entropy Analysis

Most subnet allocations are handled internally by hosting providers, making it difficult to determine the actual CIDR range being used. When you look up a full 128-bit IPv6 address, you typically get the hosting provider's base subnet information rather than the specific range your proxy is drawing from. This code solves that problem by analyzing multiple addresses to find the common prefix.

The Problem: Hidden Subnet Boundaries

When working with rotating IPv6 proxies, you're often given individual addresses without knowing the underlying subnet structure. A proxy might be rotating through thousands of addresses within a /48 or /64 range, but from the outside, each address appears independent. Understanding the actual CIDR range is useful for network analysis, indexing, or simply knowing the scope of your proxy pool.

The Solution: Bit Pattern Analysis

The approach is straightforward: collect multiple IPv6 addresses from the rotating proxy and analyze their bit patterns to find the longest common prefix. This tells us exactly where the subnet boundary lies.

Core Implementation: Finding Common Prefixes

The heart of the analysis happens in the bit comparison logic:

func findLongestCommonPrefix(ipBytes [][]byte) int {
    if len(ipBytes) == 0 {
        return 0
    }

    commonBits := 0

    for byteIndex := 0; byteIndex < 16; byteIndex++ {
        for bitIndex := 7; bitIndex >= 0; bitIndex-- {
            firstBit := (ipBytes[0][byteIndex] >> bitIndex) & 1

            allMatch := true
            for i := 1; i < len(ipBytes); i++ {
                currentBit := (ipBytes[i][byteIndex] >> bitIndex) & 1
                if currentBit != firstBit {
                    allMatch = false
                    break
                }
            }

            if allMatch {
                commonBits++
            } else {
                return commonBits
            }
        }
    }

    return commonBits
}

This function walks through each bit position across all collected IP addresses, comparing them bit by bit until it finds the first position where addresses differ. That's our subnet boundary.

Proxy Integration: Concurrent Collection

The tool fetches multiple addresses concurrently through the rotating proxy:

for i := 0; i < 20; i++ {
    wg.Add(1)
    go func(index int) {
        defer wg.Done()

        result := IPResult{}

        proxyClient, err := NewProxyClient(proxyURL)
        if err != nil {
            result.Error = fmt.Errorf("proxy client error: %v", err)
            results <- result
            return
        }

        ipv6, err := proxyClient.FetchIPv6()
        if err != nil {
            result.Error = fmt.Errorf("fetch error: %v", err)
            results <- result
            return
        }

        result.IP = ipv6
        results <- result
    }(i)
}

Network Address Calculation

Once we have the common prefix length, we calculate the network address by applying a bitmask:

func applyPrefixMask(ipBytes []byte, prefixLength int) net.IP {
    result := make([]byte, 16)
    copy(result, ipBytes)

    for i := prefixLength; i < 128; i++ {
        byteIndex := i / 8
        bitIndex := 7 - (i % 8)
        result[byteIndex] &^= (1 << bitIndex)
    }

    return net.IP(result)
}

This clears all bits after the prefix length, giving us the network address that represents the base of the CIDR range.

Data Collection Strategy

The script fetches 20 addresses by default - enough to establish a reliable pattern. In practice, even 5-10 addresses are usually sufficient to identify the CIDR boundary, but 20 provides confidence in the results.

Real-World Application

This technique is particularly useful when indexing proxy providers.

The output is minimal but informative:

Prefix Length: /48
CIDR Range: 2605:6400:49f2::/48

Why This Matters

IPv6 subnets are often much larger than their IPv4 counterparts. A /48 allocation provides 65,536 /64 subnets, each containing 18 quintillion addresses. Understanding the base subnet can aid in antivpn / proxy solutions such as Spur

The bit entropy approach works because proxy providers typically generate full 128 bit IP addresses to prevent ratelimting issues.

Code is available on GitHub - Github