Practical network support for IP traceback-英文文献.pdfVIP

Practical Network Support for IP Traceback Stefan Savage, David Wetherall, Anna Karlin and Tom Anderson Department of Computer Science and Engineering University of Washington Seattle, WA, USA Abstract attacks back towards their origin – ideally stopping an attacker at This paper describes a technique for tracing anonymous packet the source. flooding attacks in the Internet back towards their source. This work is motivated by the increased frequency and sophistication A perfect solution to this problem is complicated by the potential of denial-of-service attacks and by the difficulty in tracing packets use of indirection to “launder” the true causal origin of an attack. with incorrect, or “spoofed”, source addresses. In this paper we For example, an attack may consist of packets sent from many dif- describe a general purpose traceback mechanism based on prob- ferent slave machines, themselves under the control of a remote abilistic packet marking in the network. Our approach allows a master machine. Such indirection may be achieved either explicitly victim to identify the network path(s) traversed by attack traffic (by compromising the individual slave hosts directly) or implicitly without requiring interactive operational support from Internet Ser- (by sending false requests to the slaves on behalf of the victim – vice Providers (ISPs). Moreover, this traceback can be performed a so-called refl ector). More challenging still, the true origin and “post-mortem” – after an