Practical network support for IP traceback. - Savage, Stefan
This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back towards their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or ``spoofed'', source addresses. In this paper we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed ``post-mortem'' -- after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backwards compatible and can be efficiently implemented using conventional technology.
Keywords: Computer systems organization; Computer communication networks; Network protocols; TCP IP; Security and protection (e.g., firewalls).; Network architecture and design; Packet switching networks; Mathematics of computing; Discrete mathematics; Graph theory; Path and circuit problems; Computing milieux; Management of computing; Discrete mathematics; Graph theory; Path and circuit problems; Computing milieux; Management of computing and information systems; Algorithms; Design; Experimentation; Measurement; Performance; Security; Standardization; Theory