Search papers, labs, and topics across Lattice.
This paper investigates whether explainable rule mining can uncover human-readable patterns in IPv6 extension header (EH) presence from network captures, addressing the challenge of EH transit dropping. The authors introduce a negative-control protocol to distinguish genuine cross-packet dynamics from within-packet co-occurrences and a sender-conditioned retention measurement. The key finding is a controlled negative result: the dominant Fragment-EH signal in the JAMES dataset is a within-packet co-occurrence, not a temporal network rule, as validated by multiple baselines and synthetic controls.
Most observed IPv6 Fragment-EH patterns are simple within-packet co-occurrences, not complex temporal network rules, a finding rigorously established by a novel negative-control protocol.
IPv6 extension headers (EHs), such as fragmentation, segment routing, and in-situ telemetry, are operationally important yetwidely dropped in transit, and characterising their behaviour from packet captures is a recurring measurement problem. We ask whetheran explainable miner can recover human-readable rules of EH behaviour, and we contribute two reusable tools: a negative-control protocol that diagnoses whether a mined"temporal"network rule reflects genuine cross-packet dynamics or mere within-packetco-occurrence, and a sender-conditioned, per-family EH-retention measurement. Applying an interpretable temporal-logic rule miner to the JAMES paired-vantage dataset, we recover a portable Fragment-EH rule that the protocol reveals to be a within-packet,near-definitional co-occurrence rather than a temporal pattern, so the temporal-logic machinery does no work for this dominant rule;the retention measurement independently recovers the expected within-window ordering of EH observability. Our main result istherefore an honest, controlled negative finding, corroborated by executed decision-tree and large-language-model baselines: on theevaluated JAMES traces network-temporal structure does not carry the dominant Fragment-EH signal, and we supply the controls thatestablish when it would, validated on a synthetic positive control containing a genuine cross-packet dependency.
