# Explainable Rule Mining of IPv6 Extension-Header Presence Patterns from Paired-Vantage Captures

arXiv: https://arxiv.org/abs/2610.08090 · HTML: https://mlsanity.com/paper/2610.08090/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 2 of its 23 references that are in the map.
- First posted on arXiv 6 Oct 2026.

## Builds on (most cited first, 2 of 2)

- [Explaining Outcomes of Multi-Party Dialogues using Causal Learning](https://mlsanity.com/paper/2105.00944/) (2021)
- [Making Logic a First-Class Citizen in Generative ML for Networking](https://mlsanity.com/paper/2506.23964/) (2025)

## Abstract (arXiv)

IPv6 extension headers (EHs), such as fragmentation, segment routing, and in-situ telemetry, are operationally important yetwidely dropped in transit, and characterising their behaviour from packet captures is a recurring measurement problem. We ask whetheran explainable miner can recover human-readable rules of EH behaviour, and we contribute two reusable tools: a negative-control protocol that diagnoses whether a mined "temporal" network rule reflects genuine cross-packet dynamics or mere within-packetco-occurrence, and a sender-conditioned, per-family EH-retention measurement. Applying an interpretable temporal-logic rule miner to the JAMES paired-vantage dataset, we recover a portable Fragment-EH rule that the protocol reveals to be a within-packet,near-definitional co-occurrence rather than a temporal pattern, so the temporal-logic machinery does no work for this dominant rule;the retention measurement independently recovers the expected within-window ordering of EH observability. Our main result istherefore an honest, controlled negative finding, corroborated by executed decision-tree and large-language-model baselines: on theevaluated JAMES traces network-temporal structure does not carry the dominant Fragment-EH signal, and we supply the controls thatestablish when it would, validated on a synthetic positive control containing a genuine cross-packet dependency.