Tagged Fragment Marking Scheme with Distance-Weighted Sampling for a Fast IP Traceback

  • Ki Chang Kim
  • Jin Soo Hwang
  • Byung Yong Kim
  • Soo-Duk Kim
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2642)


IP traceback technique allows a victim to trace the routing path that an attacker has followed to reach his system. It has an effect of deterring future attackers as well as capturing the current one. FMS (Fragment Marking Scheme) is an efficient implementation of IP traceback. Every router participating in FMS leaves its IP information on the passing-through packets, partially and with some probability. The victim, then, can collect the packets and analyze them to reconstruct the attacking path. FMS and similar schemes, however, suffer a long convergence time to build the path when the attack path is lengthy. Also they suffer a combinatorial explosion problem when there are multiple attack paths. This paper suggests techniques to restrain the convergence time and the combinatorial explosion. The convergence time is reduced considerably by insuring all routers have close-to-equal chance of sending their IP fragments through a distance-weighted sampling technique. The combinatorial explosion is avoided by tagging each IP fragment with the corresponding router’s hashed identifier.


Arrival Rate Convergence Time Combinatorial Explosion Distance Field Attack Path 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    S. M. Bellovin, “The ICMP Traceback Messages,” Internet Draft: draft-bellovin-itrace-00.txt,, Mar. 2000.
  2. 2.
    Hal Burch and Bill Cheswick, “Tracing anonymous packets to their approximate source,” Unpublished paper, December 1999.Google Scholar
  3. 3.
    Computer Emergency Response Team (CERT), “CERT Advisory CA 1995-01 IP Spoofing Attacks and Hijacked Terminal Connections,”, Jan. 1995.
  4. 4.
    Computer Emergency Response Team (CERT), “CERT Advisory CA-2000-01 Denial-of-service developments,”, Jan. 2000.
  5. 5.
    David A. Curry, “UNIX System Security,” Addison Wesley, pp. 36–80, 1992.Google Scholar
  6. 6.
    Drew Dean, Matt Franklin, and Adam Stubblefield, “An algebraic approach to ip traceback,” in Network and Distributed System Security Symposium, NDSS’ 01, February 2001.Google Scholar
  7. 7.
    Dave Dittrich, “Distributed Denial of Service (DDoS) attacks/tools resource page,”, 2000.
  8. 8.
    Sven Diettrich, Neil Long, and David Dittrich, “Analyzing distributed denial of service attack tools: The shaft case,” in 14th systems Administration Conference, LISA 2000, 2000.Google Scholar
  9. 9.
    P. Ferguson and D. Senie, “Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing,” RFC 2267, Jan. 1998.Google Scholar
  10. 10.
    J.D. Howard, “An analysis of security incidents on the internet,” Phd thesis, Carnegie Mellon University, Aug. 1998.Google Scholar
  11. 11.
    L.T. Heberlein and M. Bishop, “Attack Class: Address Spoofing,” In 1996 National Information Systems Security Conference,” pages 371–378, Baltimore, MD, Oct. 1996.Google Scholar
  12. 12.
    S. Kent and J. Mogul, “Fragmentation Considered Harmful,” In Proceedings of the 1987 ACM SIGCOMM Conference, Pages 390–401, Stowe, VT, Aug. 1987Google Scholar
  13. 13.
    Jon Postel, “Internet Protocol-Darpa Internet Program-Protocol Specification,” RFC 791,, Sept. 1981.
  14. 14.
    “Project IDS — Intrusion Detection System,”, 2002.
  15. 15.
    G. Sager. Security Fun with Ocxmon and Cflowd. Presentation at the Internet 2 Working Group, Nov. 1998.Google Scholar
  16. 16.
    Stefan Savage, David Wetherall, Anna Karlin, and Tom Anderson, “Practical network support for IP traceback,” in Proc. of ACM SIGCOMM, pp. 295–306, Aug. 2000.Google Scholar
  17. 17.
    Ion Stoica and Hui Zhang, “Providing guaranteed services without per flow management,” in SIGCOMM’99, pp. 81–94, 1999.Google Scholar
  18. 18.
    R. Stone, “CenterTrack: An IP Overlay Network for Tracking DoS Floods,” In to appear in Proceedings of thje 2000 USENIX Security Symposium, Denver, CO, July. 2000.Google Scholar
  19. 19.
    Dawn Xiaodong Song and Adrian Perrig, “Advanced and Authenticated Marking Schemes for IP Traceback,” in Proc. IEEE INFOCOM, April. 2001.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2003

Authors and Affiliations

  • Ki Chang Kim
    • 1
  • Jin Soo Hwang
    • 2
  • Byung Yong Kim
    • 1
  • Soo-Duk Kim
    • 1
  1. 1.School of Information and Communication EngineeringInha Univ.Korea
  2. 2.Department of StatisticsInha Univ.Korea

Personalised recommendations