BYPASSING OF DEPLOYMENT DIFFICULTIES OF IP TRACEBACK TECHNIQUES USING NEW PASSIVE IP TRACEBACK (PATH BACKSCATTER) MECHANISM

Journal for Research | Volume 02 | Issue 08 | October 2016
ISSN: 2395-7549
All rights reserved by www.journalforresearch.org 20
Bypassing of Deployment Difficulties of IP
Traceback Techniques using New Passive IP
Traceback (Path Backscatter) Mechanism
Jigneshkumar V Madhad Asst. Prof. Anand Chauhan
ME Student Assistant Professor
Department of Computer Engineering Department of Computer Engineering
Narnarayan Shastri Institute of Technology, Jetalpur,
Ahmedabad, GTU-Gujarat, India
Narnarayan Shastri Institute of Technology, Jetalpur,
Ahmedabad, GTU-Gujarat, India
Abstract
Because so many decades World Wide Web has been used broadly in numerous fields, network safety problems include the main
matter. IP traceback is just the actual method to understand the actual purpose, it reconstructs IP packets traversed path inside the
World Wide Web to determine their own roots. IP Traceback may be an important ability for characteristics sources of attacks
and Starting protection measures for the Internet. This paper discovers different IP Traceback approaches. This comparative
paper provides as well as extends many technologies to prevent the secured information from the network issues by using
different IP traceback techniques.
Keywords: IP Traceback, Link Testing, Packet Marking, ICMP Traceback
_______________________________________________________________________________________________________
I. INTRODUCTION
Internet facilities are generally as well as widely used now-a-days to finish and do each and every task or activity. As Internet is
utilized for several tasks, attackers find a method to interrupt the services provided by it. For this reason, right now network
safety may be a necessary requirement of Internet World. Even though many security measures are adapted by the security
people to ensure security for the customers, still Internet is open for many attacks. The attacks have become so prevalent that no
security measure can prevent all of them.
So as to fortify the matter of organizations, they require systems, for example, IP Traceback procedures which will at last
decrease the possibilities of misfortunes. IP Traceback is an endeavour to follow the genuine beginning of a packet or a stream of
packets. As a result of IP Spoofing, just accepting that the packet was sent by the node indicated as the source address in its IP
header is not generally compelling, so different strategies for following packets to their root are required. Thus effective IP
Traceback methods must be utilized to discover the genuine source of attacks, with a specific end goal to take any preventive or
legitimate activities against the attackers.
IP Traceback is used to find the origins and attacking paths of malicious traffic. The task of identifying the original source of a
packet is complex as the source IP address can be fake or spoofed. So IP Traceback techniques neither prevent nor stop the
attack, they are used only to identify the source of the packets.
II. EXISTING IP TRACEBACK TECHNIQUES
Existing IP Traceback approaches can be classified into five main categories:[1]
 Link Testing
 Packet marking
 ICMP Traceback
 Logging
Link Testing[2,3]
Link testing is an approach which determines the upstream of attacking traffic hop-by-hop while the attack is in progress. The
majority of active traceback strategies begin as the router best for the target and interactively test their upstream hyperlinks till
they will decide which one is used to carry the attacker's traffic. In a perfect world, this method is rehashed recursively on the
upstream router until the source is reached. Below we summarize two varieties of link testing schemes:
Input Debugging
Numerous routers incorporate a component called input debugging. In Input Debugging, the victim needs to perceive that it is
being attacked and needs to build up an attack signature that describes a common feature contained in all the attack packets. The
most emergent problem with the input debugging approach, even with automated tools, is managing the overhead, the co-

Bypassing of Deployment Difficulties of IP Traceback Techniques using New Passive IP Traceback (Path Backscatter) Mechanism
(J4R/ Volume 02 / Issue 08 / 005)
ordination from the network admin. If the admin is unavailable or if he lacks the skill to assist the traceback, then the traceback
process may be sluggish or its completion could be unattainable.
Controlled Flooding
Another link testing traceback method called Control Flooding which does not require any support from network operators. This
method tests incoming links of the victim by iteratively flooding each link with large bursts of traffic to observe its effect on the
incoming traffic. By analyzing the change in the rate of packets received, the victim can check the source of the attack packets.
This procedure is applied to the next upstream router until the origin of attack is reached. This type of traceback by itself floods
the network. Controlled flooding is also very poorly suited for tracing distributed denial-of-service attacks because the link-
testing mechanism is inherently noisy and it can be difficult to discern the set of paths being exploited when multiple upstream
links are contributing to the attack. Finally, just like several link-testing schemes, controlled flooding is only effective at tracing
an on-going attack and cannot be used “post-mortem”.
Packet Marking
Packet marking methods relies on the routers in the network to send their identities to the destinations either by encoding this
data directly in rarely used bits of the IP Header, or by generating new packet to the same destination. The drawback is that they
require large number of attack packets to be collected by the victim to infer the attack paths.[5]
Packet marking methods needs routers modify the header of the packet to contain the information of the router and forwarding
decision. Thus the receiver of the packet can then reconstruct the path of a packet (or an attacking flow) from the received
packets.[1]
As Packet marking methods do not cost storage resource on routers and the link bandwidth resource, they are generally
considered to be lightweight. Because however, packet marking is not a largely supported function on routers; thus, it is difficult
to enable packet marking traceback in the network.
There are two approaches of packet marking schemes:
 Probabilistic Packet Marking
 Deterministic Packet Marking
Probabilistic Packet Marking[3]
Probabilistic packet marking makes use of the Identification field as the marking space and stores the link information. It
comparts the IP address into eight fragments, 4 bits for each. This IP address fragment and the same offset fragment of the next
router compose the edge fragment with 8 bits. The offset flag needs 3 bits for eight fragments, and the last 5 bits show the hop
number. It is reported that few packets exceed 25 hops in the forwarding network[9]
. When a router decides to mark a packet, it
selects a random fragment of its IP address, and records the fragment offset with the distance field set to 0. The plus point of
PPM is that it needs no storage overhead for each router. But the drawbacks are Victim needs a large number of packets to
reconstruct the attack path, and PPM does not have the ability to trace a single packet.
Fig. 1: Probabilistic Packet Marking Method
Probabilistic Packet Marking Method[2,9]
is shown in Fig. 1. In this techniques, each router marks the packet with some
probability say p for example p = 1/100 which implies marking one packet for every 100 packets received. The marking field
uses 16 bits identification field in header, of which 5 bits are used for marking hop count, which would be an useful information
during reconstruction of attack path, and the remaining bits are used by the router to send its information.
Larger information can be broken into fragments and marked in multiple packets. The marked packets will thus contain only
partial information of the path. This reduces the storage overhead in the packets. The victim has to receive sufficient packets to
re-construct the path. Prior knowledge of the topology does not require in this scheme. The disadvantage of this scheme is that it
produces many false positives and the mark field value written by routers away from victim might be overwritten by the routers
closer to the victim and if the attacker is aware of the scheme, then the traceback fails. The marking field is used to hold start,

(J4R/ Volume 02 / Issue 08 / 005)
end and distance. The start and end fields save the IP addresses of the routers residing at the two end points making an edge and
the distance field registers the number of hops between this edge marked and the victim.
Deterministic Packet Marking[3]
Fig. 2: Deterministic Packet Marking Method
Deterministic Packet Marking scheme (DPM) is shown in Fig. 2. This technique overcomes the disadvantages of PPM. Every
packet passing through the first ingress edge router is only marked with the IP address of the router. The IP address is comparted
into two fragments (16 bits each) and each fragment is randomly recorded into each inflowing packet. The entire IP address is
recovered by the victim when it obtains both the fragments of the same ingress router. This technique fails when the source
address is spoofed and is also false positive. The enhanced schemes[7,8]
are proposed where the IP address is divided into more
fragments, and a hash function is used to contain the identity of the ingress router to reduce the false positive. Deterministic
packet marking based on redundant decomposition is proposed in[10]
. The knowledge of topology plays a significant role in DPM
scheme’s traceback. Consider the DPM scheme suggested in [11]
where, it is assumed that the topology of the network is known
in advance. The packet marking method involves hash of ingress router’s IP address. The hash value is divided into chunks and
each chunk is marked into the packet randomly. With the topology known, the victim performs traceback of the marked routers.
Large numbers of packets are not required for traceback in this method but it consumes a longer search time to identify the
origin. The traceback scheme is challenged, if the topology is modified.
When an intermediate router goes off, the traceback can be carried out with the topology but might turn to be false positive. If
the attacker modifies the mark field, this scheme will fail to traceback. Instead of IP address respective bit fields were marked
in[12]
. In Flexible Deterministic Packet Marking (FDPM) scheme[13,14]
, the marking field length is varied according to the
requirement. The length of the marking field is flexible and can be adjusted. Further, the marking rate can also be adaptively
changed according to the incoming traffic load on the participating router. FDPM is capable of tracing a large number of real
sources with low false positive rate and low resource requirement on routers.
ICMP Traceback[3]
Internet Control Message Protocol (ICMP) in would like of trace out full path of the attacks. Typically this scheme is for each
router to come up with an ICMP traceback message or reach directed to the identical destination because the elite packet. The
trace message consists of consequent and previous hop data and a time stamp.
Fig. 3: ICMP Traceback
A traceback scheme using the explicitly generated ICMP Traceback message was proposed in[15]
. Each router samples the
forwarding packets with a low probability (e.g. 1/20000) and sends a special ICMP message including the information like

(J4R/ Volume 02 / Issue 08 / 005)
neighboring routers (forward and backward links) on the path to the destination and source along with the original (triggering)
packet. Traceback packet moreover includes an authentication field which guards against spoofed traceback packets sent from
attackers. This field can be null authentication, random strings or even HMACs. TTL is set to 255 for computing distance at the
receiving end. On DDoS flooding attack, these ICMP traceback messages are used by the victim to reconstruct the path taken by
the attacker. The schematic representation of the scheme is shown in Figure 5. The updated version of the previous iTrace (ICMP
Traceback) method was proposed in[16]
. iTrace scheme is considered as an industry standard by IETF. The duration for path
reconstruction by iTrace is minimized in ICMP Traceback with cumulative path (iTrace CP)[17]
. This scheme is independent of
the attack length. This scheme encodes the entire attack path data (i.e. contains the addresses of all the routers on the attack path)
into minimal number of packets, thus synchronizing the attack path construction time. This is successfully achieved at the
expense of minimal additional overhead in computation, storage and bandwidth. An enhancement to this scheme is suggested in
Enhanced ICMP Traceback with Cumulative Path[18]
, which suggests the exponential increase in the probability of message
generation with the distance in hops from the victim. The output of the scheme relies on selecting the appropriate value for the
probability exponent which affects the traceback duration for attack paths of different length. The iTrace scheme suffers a serious
problem on the resource spent for generating the number of traceback packets that turns out to be neither useful nor informative
during traceback and this particular issue is addressed in Intention-driven ICMP traceback[19]
which enhances the probability of
the router to generate useful trace messages. This is achieved by adding an additional intention bit to the iTrace message. A
modification to Intention driven traceback is provided in[20]
to create more effective iTrace packets to detect the origin of attack
more accurately..
Logging[3]
This solution contains storing packet digests or signatures at intermediate routers. The drawbacks of this technique include
significant amount of resources that have to be reserved at intermediate routers and hence large overhead on the network,
complexity, centralized management.
Fig. 4: Logging Packet
Logging is used to log packets at key routers and so use data-mining techniques to see the trail that the packets traversed. It
has the important property that it will trace an attack long once the attack has completed. This mechanism has drawbacks, and
probably huge resource needs and large scale interprovider information integration tough.
Logging technique for IP traceback stores the information like packet’s digest, signature, and fields of IP header on all or few
routers which forward packets inside the domain. It is shown in Figure 6. When an attack is detected, the victim requests the
upstream router to gather relevant information about attack packet. If the information is found, then the router is counted as a hop
in the attack path and the procedure is again repeated.
III. PASSIVE IP TRACEBACK
In natural Internet-scale Passive IP traceback (PIT) approach requires no ISP deployment. PIT analyzes packets collected from
the network telescopes, and infers the locations of spoofed traffic. The intuition behind PIT is that spoofing flows might trigger
ICMP error messages at routers on the path to victim. These ICMP messages are sent to the spoofed nodes. Under the
assumption, that the attackers will use randomly forged addresses, some of these ICMP messages will be received by the
network telescopes. The addresses of routers sending the message can be merged with an Internet route model to re-generate the
attack path and find the locations of the spoofers.

(J4R/ Volume 02 / Issue 08 / 005)
IV. PROPOSED SYSTEM
A novel solution, named as Passive IP Traceback (PIT), is proposed to bypass the challenges in deployment. Not all the packets
reach their destinations. Router may fail to forward an IP Spoofing packet due to various reasons. e.g., TTL exceeding. In such
cases, the routers might generate an ICMP error message (named path backscatter) and then send the message to the spoofed
source address. Since the routers can be close to the spoofers, the path backscatter messages may potentially reveal the locations
of the spoofers. This scenario is illustrated in Fig. 5.
Fig. 5: The scenario of Path Backscatter Generation and Collection
PIT exploits these path backscatter messages to find the location of the spoofers. With the locations of the spoofers known, the
victim can seek help from the corresponding ISP to filter out the attacking packets, or take other counterattacks.
As specified by RFC792[8]
, the format of the path backscatter messages, is illustrated in Fig. 6. Each message contains the
source address of the reflecting device, and the IP header of the original packet. Thus, from each path backscatter, we can get 1)
the IP address of the reflecting device which is on the path from the attacker to the destination of the spoofing packet; 2) the IP
address of the original destination of the spoofing packet.
Fig. 6: The Format of Path Backscatter Messages
Methodology for Problem Solution
Tracking Mechanism
In the proposed system, The Network is abstracted as Graph G (V, E). Where, V is the set of all the network nodes and E is the
set of all the Links. A network node can be a router or an AS (Anonymous System).
Whenever a path backscatter message captured, the most direct assumption is that the packet from attacker to od should
bypass r. Where Source is Router r (named reflector) and Original destination is od.
The Block diagram of the Proposed System shows the Spoofing origin tracking mechanism. UCSD network telescope
captured the path backscatter messages. From each path backscatter message, the node r (r Є V) which generates the spoofing
packet & the original destination od (od Є V) of the spoofing packet can be got.
We have to Identify minimal set of nodes through which packet can Bypass the Source of Spoofing (Router / AS) for Current
communication. Denote the location of the spoofer by a, a Є V., i.e., the nearest router or the origin AS. We make use of path
information to help track the location of the spoofer.
Another task is to get Current path & all paths for current Route of communication with the help of the routing protocols. We
use path (v, u) to denote the sequence of nodes on one of the path from v to u and use PATH (v, u) to denote the set of all the
paths from v to u.
Then we need to identify minimal set of nodes through which packet can Bypass the Source of Spoofing (Router / AS) for
Current communication. Use φ (r, od) to denote the set of nodes from each of which a packet to od can bypass r, i.e.
φ (r, od) = {v | r Є path(v, od), path(v, od) Є PATH(v, od)}
φ (r, od) actually determines the minimal set which must contain the spoofer. We name the result set of φ (r, od) by suspect set
Suspect set: φ (Router A, Receiver) = {Attacker, Router A}

(J4R/ Volume 02 / Issue 08 / 005)
Fig. 5: Block diagram of the Proposed System
Fig. 6: The suspect set determined by a path backscatter message.
Tracking without routing information
It should be noted that if the routing does not have any constraint, packets from any node v Є V to od can bypass any
intermediate node r. Then the tracking is meaningless. Fortunately, it is not the case in real networks. We make use of two
assumptions on the routing respectively:
 Loop-Free Assumption: This assumption states there is no loop in the paths. This assumption always holds unless
misconfiguration occurs or the routing has not converged.
 Valley-free assumption: This assumption states there should be no valley in the AS level paths. Though the increased
complexity of AS relationship has reduced the universality of this assumption, it is yet the most common model of AS level
routing.
a) Tracking on Loop-Free Assumption:
On the basis of loop-free assumption, a vertex v is in the φ (r, od) if and only if there is at least one loop-free path from v to od
passing r.
Denote a loop-free path from v to u by lfpath (v, u), which is a sequence of verticals along the path. Then the suspect set is
b) Tracking on Valley-Free Assumption:
Based on the valley-free assumption, a vertex v is in the φ (r, od) if and only if there is at least one valley-free path from v to od
passing r.

(J4R/ Volume 02 / Issue 08 / 005)
Denote a valley-free path from v to u by vfpath (v, u), which is a sequence of verticals along the path. Then the suspect set is
Implementation Modules
Network Topology Construction
A Network Topology might consist of the no. of routers that are connected with local area networks. Thus, a router can receive
data from the nearer router or else from the local area network. A border router receives packets from its local network. Then, a
core router receives packets from other routers. The no.of routers connected to a single router is known as the degree of a router.
This is calculated and stored in a table. The Upstream interfaces of each router also have to be found and stored in the interface
table.
Path Selection
The path is the way in which the selected packet or file has to be sent from the source to the destination. The Upstream interfaces
of each router have to be searched and it is stored in the interface table. With the help of that interface table, then the desired path
between the selected source and destination can be defined.
Packet Sending
One of the Packet or file is selected for the transformation process. The packet is further sent along the defined path from the
source LAN to the destination LAN. The destination LAN receives the packet and checks whether that it has been sent along the
defined path or not.
Packet Marking and Logging
In Packet Marking, the efficient Packet Marking algorithm is applied at each router along the defined path. It calculates the
Pmark value and then stores in the hash table. If the Pmark is not overflow than the capacity of the router, then it is sent to the
next router. Otherwise, it refers the hash table and again applies the algorithm.
Path Reconstruction
When the Packet has reached the destination after successfully applying the Algorithm, there it checks whether it has sent from
the correct upstream interfaces. After that, If any of the attack is found, it request for the Path Reconstruction. The Process of
finding out the new path for the same source and the destination in which no attack can be made is called Path Reconstruction.
V. CONCLUSION
In this Passive IP Traceback (PIT) tracks spoofers based on path backscatter messages and the public available information, the
locations of spoofers can be captured through applying PIT on the path backscatter. Hence this technique, can reveal IP spoofing
and the more number of spoofers can be retrieved, with more efficiency and the execution is also improved by this technique.
REFERENCES
[1] Guang Yao; Jun Bi; Vasilakos, A.V., "Passive IP Traceback: Disclosing the Locations of IP Spoofers From Path Backscatter," in Information Forensics and
Security, IEEE Transactions on , vol.10, no.3, pp.471-484, March 2015 doi: 10.1109/TIFS.2014.2381873
[2] S. Savage, D. Wetherall, A. Karlin, and T. Anderson, “Practical network support for ip traceback,” in Proceedings of the Conference on Applications,
Technologies, Architectures, and Protocols for Computer Communication, ser. SIGCOMM ’00. New York, NY, USA: ACM, 2000, pp. 295–306.
[3] Vijayalakshmi Murugesan, Mercy Shalinie, and Nithya Neethimani, “A Brief Survey of IP Traceback Methodologies”, Department of Computer Science
and Engineering, Thigarajar College of Engineering, Thiruparankundram, Madurai – 625015, Tamilnadu, India
[4] DONG YAN, YULONG WANG, SEN SU and FANGCHUN YANG A Precise and Practical IP Traceback Technique Based on Packet Marking and
Logging State Key Laboratory of Networking and Switching Technology Beijing University of Posts and Telecommunications Beijing, 100876 P.R. China
[5] B. Sai Priyanka, N. Srihari Rao, “IP Traceback Techniques – A Selective Survey” Department of Computer Science & Engineering, CMR Institute of
Technology, Hyderabad, A.P International Journal of Computer Science and Mobile Applications, Vol.1 Issue. 3, September- 2013, pg. 40-44 ISSN: 2321-
8363
[6] K. Arun Kumar, K. Sai Ashritha, “Analysis of Various IP Traceback Techniques - A Survey” Department of Computer Science & Engineering, CMR
Institute of Technology, Hyderabad, A.P International Journal of Computer Science and Mobile Applications (0975 – 8887), Volume 77– No.13,
September 2013ISSN: 2321-8363
[7] A. Belenky and N. Ansari, “Ip traceback with deterministic packet marking,” IEEE Communications Letters, vol. 7, no. 4, pp. 162–164, 2003.
[8] Belenky and N. Ansari: On Deterministic Packet Marking, Computer Networks, Vol. 51, No. 10, 2007, pp. 2677-2700
[9] S. Savage, D. Wetherall, A. R. Karlin, T. E. Anderson: Network Support for IP Traceback, IEEE/ACM Transactions on Networking, Vol. 9, No. 3, 2001,
pp. 226-237
[10] G. Jin and J. Yang: Deterministic Packet Marking Based on Redundant Decomposition for IP Traceback, IEEE Comm. Letters, Vol. 10, No. 3, 2006, pp.
204-206
[11] Wang Xiao-jing, Wang Xiao-yin: Topology Assisted Deterministic Packet Marking for IP Traceback, The Journal of China Universities of Posts and
Telecommunications, Vol. 17, No. 2, April 2010, pp. 116-121
[12] Y. Kim, J. Y. Jo, and F. L. Merat: Defeating Distributed Denial-of-Service Attack with Deterministic Bit Marking, Proc. IEEE Global Telecomm. Conf.
(GLOBECOM ’03), 2003, pp. 1363-1367
[13] Y. Xiang, W. Zhou, and J. Rough: Trace IP Packets by Flexible Deterministic Packet Marking (FDPM), Proc. IEEE Int’l Workshop IP Operations and
Management (IPOM ’04), 2004, pp. 246-252
[14] Y.Xiang, W.Zhou and M.Gu: Flexible Deterministic Packet Marking: An IP Traceback System to Find the Real Source of Attacks, IEEE Trans. Parallel
and Distributed System, Vol. 20, No. 4, April 2009, pp. 567- 580
[15] S. M. Bellovin: ICMP Traceback Messages, Internet Draft: draft-bellovin-itrace-00.txt, 2000
[16] S. M. Bellovin, M. D. Leech, and T. Taylor: ICMP Traceback Messages, Internet Draft: Draft-Ietf-Itrace-04.Txt, Feb. 2003

BYPASSING OF DEPLOYMENT DIFFICULTIES OF IP TRACEBACK TECHNIQUES USING NEW PASSIVE IP TRACEBACK (PATH BACKSCATTER) MECHANISM

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to BYPASSING OF DEPLOYMENT DIFFICULTIES OF IP TRACEBACK TECHNIQUES USING NEW PASSIVE IP TRACEBACK (PATH BACKSCATTER) MECHANISM (20)

More from Journal For Research (20)

Recently uploaded (20)

BYPASSING OF DEPLOYMENT DIFFICULTIES OF IP TRACEBACK TECHNIQUES USING NEW PASSIVE IP TRACEBACK (PATH BACKSCATTER) MECHANISM