1. Detect and Prevent Rogue Traffic in Mobile Ad Hoc Networks
Merlin Vincent
2/27/2019
Merlin Vincent, CS522 Research Project

2. Merlin Vincent, CS522 Research Project
Mobile Ad Hoc Networks
What are Mobile Ad Hoc Networks?
Self-organizing wireless networks
No infrastructure (switches, base stations)
No central administration
All nodes perform routing functions
High node mobility
2/27/2019
Merlin Vincent, CS522 Research Project

3. Merlin Vincent, CS522 Research Project
Rogue Traffic
What is rogue traffic?
Unauthorized messages
Recorded and replayed into the network
duplicates still must be processed
if accepted, can wreak havoc in applications
Generated by the adversary
incapacitate through invalid data
denial of service attack
2/27/2019
Merlin Vincent, CS522 Research Project

4. Merlin Vincent, CS522 Research Project
Countermeasures
Against replayed traffic
extremely difficult - looks valid
authentication is expensive
Against generated traffic
denial of service techniques
ingress filtering • link testing
logging • packet marking
ICMP traceback
2/27/2019
Merlin Vincent, CS522 Research Project

5. ICMP Traceback Message (itrace)
backward link
forward link
timestamp
router ID
probability
authentication
traced packet contents
2/27/2019
Merlin Vincent, CS522 Research Project

6. Forward/Backward Links
Path information
Interface name
IPv4 or IPv6 address pair
address that packet arrived on
address of the next hop
possibly several pairs of these
MAC address pair, or
Operator defined Identifier
2/27/2019
Merlin Vincent, CS522 Research Project

7. Merlin Vincent, CS522 Research Project
itrace Strategy
itrace messages generated randomly
one in 20,000 messages
Sent to packet destination
Large volume of traffic required
eventually able to derive entire path
but can you identify the attacker?
but can you disable the attacker?
2/27/2019
Merlin Vincent, CS522 Research Project

8. Merlin Vincent, CS522 Research Project
Conclusion
itrace can be helpful
in conjunction with packet marking
incorporated into routing system
But once the attacker is identified?
possibly steer antenna nulls
questionable, even in wired networks
2/27/2019
Merlin Vincent, CS522 Research Project