IP traceback

IP traceback is any method for reliably determining the origin of a packet on the Internet. The IP protocol does not provide for the authentication of the source IP address of an IP packet, enabling the source address to be falsified in a strategy called IP address spoofing, and creating potential internet security and stability problems. Use of false source IP addresses allows denial-of-service attacks (DoS) or one-way attacks (where the response from the victim host is so well known that return packets need not be received to continue the attack ). IP traceback is critical for identifying sources of attacks and instituting protection measures for the Internet. Most existing approaches to this problem have been tailored toward DoS attack detection. Such solutions require high numbers of packets to converge on the attack path(s).

IP traceback is any method for reliably determining the origin of a packet on the Internet. The IP protocol does not provide for the authentication of the source IP address of an IP packet, enabling the source address to be falsified in a strategy called IP address spoofing, and creating potential internet security and stability problems. Use of false source IP addresses allows denial-of-service attacks (DoS) or one-way attacks (where the response from the victim host is so well known that return packets need not be received to continue the attack ). IP traceback is critical for identifying sources of attacks and instituting protection measures for the Internet. Most existing approaches to this problem have been tailored toward DoS attack detection. Such solutions require high numbers of packets to converge on the attack path(s). These bounds were improved by Adler, Edmonds, and Matoušek. For a single attack path, they proved that any memoryless PPM scheme requires at least \Omega\!\big(2^{b}\cdot 2^{\,2n/(2^{b}-1)}\big) packets. They also gave a near-matching (“quasi-optimal”) upper bound: in a model with m routers where each router chooses one of s possible messages ( n = m\cdot \log_{2}(s) ), they show that O\big(m\cdot 2^{2m\log_{2}(s)/(2^{b}-1)}\big) packets suffice. Thus, the true bound is roughly the square root of the upper bound originally provided by Adler, and roughly the square of his lower bound. The paper also presents a new protocol and analysis for multi-path attacks, generalizing the scenarios in which PPM remains effective.

Text derived from https://en.wikipedia.org/w/index.php?oldid=1351257754 under CC BY-SA 4.0; modifications have been made.