1. Practical Network Support for IP Traceback Internet Systems and Technologies - Monitoring

2. Contents  Introduction  The traceback approach  Edge sampling algorithm  Phase 1: The marking procedure  Phase 2: The path reconstruction  Evaluation  Compressed edge fragment sampling  IP header encoding  The coverage time  Conclusion

3. Introduction  Denial-of-service attacks - consume resources of a remote host or network, denying or degrading service to legitimate users.  Traceback problem - trace attacks back to their origin  “spoofed” IP source addresses  Stateless Internet routing  Goal - identify the machines that directly generate attack traffic

4. The sampling traceback approach  Probabilistically mark packets with partial path information as they arrive at routers.  Combine such packets to reconstruct the entire path.  “post-mortem” traceback

5. The “Edge sampling” algorithm  Reserve 2 fields in packet, start and end and one field for distance  Upon receiving a packet, each router chooses to “mark” it with some probability p.  Form an edge between two consecutive routers

6. Phase 1: The marking procedure number of hops traversed since the edge was sampled

7. Phase 2: The path reconstruction The victim uses the edges sampled to create a graph leading back to the source of attack.

8. Evaluation Can efficiently discern multiple attacks Robust- it is impossible for any edge closer than the closest attacker to be spoofed, due to the robust distance determination. × Not backwards compatible - requires additional space in the IP packet header

9. Compressed edge fragment sampling  Goal : reduce per-packet storage requirements while preserving robustness.  Three techniques:  represent the edge as the exclusive-or (XOR) of the two IP addresses  subdivide each edge-id into k non-overlapping fragments  Increase the size of each router address by bit-interleaving its IP address with a hash of itself

10. IP header encoding  Identification field - used to differentiate IP fragments that belong to different packets  backwards-compatibility issues  Upstream  prepend a new ICMP “echo reply” header, along with the full edge data at the tail of the packet  Downstream  set the Don't Fragment flag on every marked packet

11. The coverage time  The number of packets that the victim must observe to reconstruct the attack path.  Most paths can be resolved with between one and two thousand packets  flooding-style denial of service attacks send many hundreds or thousands of packets each second

12. Conclusion  Denial-of-service attacks motivate the development of improved traceback capabilities  Edge sampling, can enable efficient and robust multi-party traceback  One potential deployment strategy is based on overloading existing IP header fields

13. References  Stefan Savage, David Wetherall, Anna Karlin, and Tom Anderson. Practical Network Support for IP Traceback. In Proceedings of the 2000 ACM SIGCOMM Conference, pages 295--306, Stockholm, Sweden, August 2000Practical Network Support for IP Traceback