IP Traceback Methods

CHAPTER 1

INTRODUCTION

1.1 Overview:

Network security consists of the provisions and policies adopted by a network administrator to prevent and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves the authorization of access to data in a network, which is controlled by the network administrator. Users choose or are assigned an ID and password or other authenticating information that allows them access to information and programs within their authority. Network security covers a variety of computer networks, both public and private, that are used in everyday jobs conducting transactions and communications among businesses, government agencies and individuals.

The source of attack can be actual host or network of origin, or compromised routers within the enabled network. The attack path, comprises the routers traversed by packets from the “source” to the victim. In the case of a DDoS attack, packets may come from potentially many secondary sources, hence many attack paths. The attack graph is defined as the set of attack paths.

[3] A.John, T.Siva Kumar “DDoS: Survey of Traceback Methods”, International Journal of Recent Trends in Engineering, Vol.1, No.2, pp.241-245 May 2009.

Probabilistic packet marking (PPM) is based on marking the packets probabilistically along the delivery path with the IP address of the router. Marking with PPM is carried out on hop-by-hop basis. It uses just a single entry in the IP header to store markings. Each router on the path from the source to the destination writes down its unique identifier in the entry in the packet header with some probability. By writing into the entry, routers overwrite any previous entry that was present there. Probabilistic packet marking (PPM) as a network support for practical IP

The firewall drops all the packets that have source addresses that do not belong to their local network. This stops an attacker from using hosts within that network as DDoS agents.

Ingress/Egress filtering makes it difficult for attackers to launch attacks using spoofed IP addresses. As we have seen that IP spoofing is required for some attacks like the Smurf (ping flood) to work. Furthermore, IP spoofing makes it difficult to trace back the attack to the actual originating host. If on detection of a DDoS attack, the traffic is dropped based on just the IP source address, then the network whose source address was spoofed is also denied access. This in itself is a denial of service for the end-users on that