CONFERENCE PROGRAM
Program at a glance   Tutorial program   Technical program   Abstracts   Papers

Abstract

Session
Tracing and Measurement
Paper
8-4
Full Paper
ps.gz
Title
Practical Network Support For IP Traceback
Author(s)
Stefan Savage (University of Washington)
David Wetherall (University of Washington)
Anna Karlin (University of Washington)
Tom Anderson (University of Washington)
Abstract:
This paper describes a technique for tracing anonymous attacks back to their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or ``spoofed'', source addresses. In this paper we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by an attacker without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed ``post-mortem'' -- after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backwards compatible and can be efficiently implemented using conventional technology.