This approach would require more state information in each packet than simple node marking but would converge much faster. The second approach, edge marking, requires that the two nodes that make up an edge mark the path with their IP addresses along with the distance between them. They propose that the router mark the packet with either the router’s IP address or the edges of the path that the packet traversed to reach the router.įor the first alternative, marking packets with the router's IP address, analysis shows that in order to gain the correct attack path with 95% accuracy as many as 294,000 packets are required.

suggested probabilistically marking packets as they traverse routers through the Internet. Such solutions require high numbers of packets to converge on the attack path(s). Most existing approaches to this problem have been tailored toward DoS attack detection. IP traceback is critical for identifying sources of attacks and instituting protection measures for the Internet. Use of false source IP addresses allows denial-of-service attacks (DoS) or one-way attacks (where the response from the victim host is so well known that return packets need not be received to continue the attack ). The IP protocol does not provide for the authentication of the source IP address of an IP packet, enabling the source address to be falsified in a strategy called IP address spoofing, and creating potential internet security and stability problems. IP traceback is any method for reliably determining the origin of a packet on the Internet.

Ip logger ddos