IP Trace back: To Disclose the Locations of IP Spoofers from Path Backscatter Messages

Abstract

Disclosing the IP of spoofer or attacker traceback is an open and challenging issue.Deterministic Packet
Marking (DPM) is a simple and efficient traceback mechanism,but the current DPM based traceback schemes are not
practical due to their scalability constraint.After all,due to the objection of distribution, there has been not a widely accept
IP traceback solution, at least at the Internet level.As a result, the mist on the locations of spoofers has never been
dissipated till now. FIT investigates Internet Control Message Protocol (ICMP) error messages (named path backscatter)
triggered by spoofing traffic, and tracks the spoofers based on public available information (e.g., topology). In order to
traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional
DPM strategy. This system proposes feasible IP (FIT) traceback that bypasses the deployment difficulties of IP traceback
techniques. FIT investigates Internet Control Message Protocol (ICMP) error messages (named path-backscatter) cause
by spoofing traffic, and tracks the spoofers based on public available information (e.g., topology). In order to traceback to
confusing attack source, what we need to do is to mark these convoluted ingress routers using the traditional DPM
strategy.These results can help further reveal IP spoofing, which has been studied for long but never well understood.
Though FIT cannot work in all the spoofing attacks, it may be the most useful mechanism to trace spoofers before an
Internet-level traceback system has been deployed in real.