Hash-based IP traceback

TLDR

IP packets are hard to trace because the protocol design and common forwarding techniques such as NAT and encapsulation obscure their true source, and existing methods only handle large flows, not individual packets. The authors propose a hash‑based IP traceback technique that creates audit trails and can identify the origin of a single packet delivered recently. The technique hashes packet headers to build compact audit trails stored in routing hardware, and the authors show it can be implemented with only about 0.5 % of link capacity per unit time in storage. Analytic and simulation results confirm the system is effective, space‑efficient, and implementable in current or next‑generation routers.

Abstract

The design of the IP protocol makes it difficult to reliably identify the originator of an IP packet. Even in the absence of any deliberate attempt to disguise a packet's origin, wide-spread packet forwarding techniques such as NAT and encapsulation may obscure the packet's true source. Techniques have been developed to determine the source of large packet flows, but, to date, no system has been presented to track individual packets in an efficient, scalable fashion.We present a hash-based technique for IP traceback that generates audit trails for traffic within the network, and can trace the origin of a single IP packet delivered by the network in the recent past. We demonstrate that the system is effective, space-efficient (requiring approximately 0.5% of the link capacity per unit time in storage), and implementable in current or next-generation routing hardware. We present both analytic and simulation results showing the system's effectiveness.