Practical network support for IP traceback

Abstract--This paper describes a technique for tracing anony-mous packet flooding attacks in the Internet back toward their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or "spoofed, " source addresses. In this paper, we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our ap-proach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed "post mortem"--after an attack has completed. We present an implementation of this technology that is incremen-tally deployable, (mostly) backward compatible, and can be effi-ciently implemented using conventional technology. Index Terms--Computer network management, computer network security, network servers, stochastic approximation