Hardware support for a hash-based IP traceback

Sánchez, Luis; Milliken, W.; Snoeren, Alex C.; Tchakountio, Fabrice; Jones, Christine E; Kent, Stephen; Partridge, Craig; Strayer, W.T.

doi:10.1109/discex.2001.932167

Cited by 33 publications

(12 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Figure 7 depicts a possible implementation of a SPIE Data Generation Agent in hardware for use on high-speed routers. A full discussion of the details of the architecture and an analysis of its performance were presented previously [26]. Briefly, each interface card in the router is outfitted with an Interface Tap which computes multiple independent digests of each packet as it is forwarded.…”

Section: Practical Implementationmentioning

confidence: 99%

Single-packet IP traceback

Snoeren¹,

Partridge²,

Sánchez³

et al. 2002

IEEE/ACM Trans. Networking

Self Cite

352

237

View full text Add to dashboard Cite

Abstract-The design of the IP protocol makes it difficult to reliably identify the originator of an IP packet. Even in the absence of any deliberate attempt to disguise a packet's origin, wide-spread packet forwarding techniques such as NAT and encapsulation may obscure the packet's true source. Techniques have been developed to determine the source of large packet flows, but, to date, no system has been presented to track individual packets in an efficient, scalable fashion. We present a hash-based technique for IP traceback that generates audit trails for traffic within the network, and can trace the origin of a single IP packet delivered by the network in the recent past. We demonstrate that the system is effective, space-efficient (requiring approximately 0.5% of the link capacity per unit time in storage), and implementable in current or next-generation routing hardware. We present both analytic and simulation results showing the system's effectiveness.

show abstract

Section: Practical Implementationmentioning

confidence: 99%

Single-packet IP traceback

Snoeren¹,

Partridge²,

Sánchez³

et al. 2002

IEEE/ACM Trans. Networking

Self Cite

352

237

View full text Add to dashboard Cite

show abstract

“…The speed of DGA to handle packet digests is 10% of the link rate for the OC-192 link [10]. The transmission rate of OC-192 is 9.953Gb/s.…”

Section: Performance Evaluationmentioning

confidence: 99%

An Efficient Collaborative Traceback Scheme Based on Packet Digests Logging

Yan

Wang

Sen

et al. 2010

2010 10th IEEE International Conference on Computer and Information Technology

View full text Add to dashboard Cite

It is important for us to determine the source of the Attack, when we want to defend against the malicious actions, such as (D)DoS. Log-based technology is to log the packets information, which can mean how the packets traverse the network. Source Path Isolation Engine (SPIE) is a great development in log-based technology, but it still has some shortages. In this paper, we proposed a collaborative traceback scheme based on packet digests (DCTS) to improve the SPIE, which can reduce the impact to network status introduced by the process of traceback efficiently. Then we evaluated the performance of the scheme in the paper.

show abstract

“…For example, Feghali et al [31] presented an implementation of wellknown private-key encryption algorithms on the Intel IXP28xx network processors to keep pace with a 10-Gbps forwarding rate. Furthermore, Sanchez et al [32] demonstrated hardware support to compute fingerprints at wire speed of high speed routers (OC-48 and faster).…”

Section: Computing Fingerprintsmentioning

confidence: 99%

Detecting Malicious Packet Losses

Mzrak

Savage

Marzullo

2009

IEEE Trans. Parallel Distrib. Syst.

View full text Add to dashboard Cite

Abstract-In this paper, we consider the problem of detecting whether a compromised router is maliciously manipulating its stream of packets. In particular, we are concerned with a simple yet effective attack in which a router selectively drops packets destined for some victim. Unfortunately, it is quite challenging to attribute a missing packet to a malicious action because normal network congestion can produce the same effect. Modern networks routinely drop packets when the load temporarily exceeds their buffering capacities. Previous detection protocols have tried to address this problem with a user-defined threshold: too many dropped packets imply malicious intent. However, this heuristic is fundamentally unsound; setting this threshold is, at best, an art and will certainly create unnecessary false positives or mask highly focused attacks. We have designed, developed, and implemented a compromised router detection protocol that dynamically infers, based on measured traffic rates and buffer sizes, the number of congestive packet losses that will occur. Once the ambiguity from congestion is removed, subsequent packet losses can be attributed to malicious actions. We have tested our protocol in Emulab and have studied its effectiveness in differentiating attacks from legitimate network behavior.

show abstract

Hardware support for a hash-based IP traceback

Abstract: The

Cited by 33 publications

References 8 publications

Single-packet IP traceback

Single-packet IP traceback

An Efficient Collaborative Traceback Scheme Based on Packet Digests Logging

Detecting Malicious Packet Losses

Contact Info

Product

Resources

About