Sciweavers

SIGCOMM
2010
ACM

Passive IP traceback: capturing the origin of anonymous traffic through network telescopes

13 years 12 months ago
Passive IP traceback: capturing the origin of anonymous traffic through network telescopes
IP traceback can be used to find the origin of anonymous traffic; however, Internet-scale IP traceback systems have not been deployed due to a need for cooperation between Internet Service Providers (ISPs). This article presents an Internet-scale Passive IP Trackback (PIT) mechanism that does not require ISP deployment. PIT analyzes the ICMP messages that may scattered to a network telescope as spoofed packets travel from attacker to victim. An Internet route model is then used to help re-construct the attack path. Applying this mechanism to data collected by Cooperative Association for Internet Data Analysis (CAIDA), we found PIT can construct a trace tree from at least one intermediate router in 55.4% the fiercest packet spoofing attacks, and can construct a tree from at least 10 routers in 23.4% of attacks. This initial result shows PIT is a promising mechanism. Categories and Subject Descriptors: C.2.0 [ComputerCommunication Networks]: General
Guang Yao, Jun Bi, Zijian Zhou
Added 06 Dec 2010
Updated 06 Dec 2010
Type Conference
Year 2010
Where SIGCOMM
Authors Guang Yao, Jun Bi, Zijian Zhou
Comments (0)