TTL Based Packet Marking for IP Traceback

— Distributed Denial of Service Attacks continue to pose major threats to the Internet. In order to traceback attack sources (i.e., IP addresses), a well studied approach is Probabilistic Packet Marking (PPM), where each intermediate router of a packet marks it with a certain probability, enabling a victim host to traceback the attack source. In a recent study, we showed how attackers can take advantage of probabilistic nature of packet markings in existing PPM schemes to create spoofed marks, hence compromising traceback. In this paper, we propose a new PPM scheme called TTL-based PPM (TPM) scheme, where each packet is marked with a probability inversely proportional to the distance traversed by the packet so far. Thus, packets that have to traverse longer distances are marked with higher probability, compared to those that have to traverse shorter distances. This ensures that a packet is marked with much higher probability by intermediate routers than by traditional mechanisms, hen...

• Type: Conference
• Year: 2008
• Where: GLOBECOM
• Authors: Vamsi Paruchuri, Arjan Durresi, Sriram Chellappan
• Keywords: GLOBECOM 2008, Intermediate Routers, Packet Markings, Ppm Scheme, Telecommunications