Single-Packet IP Traceback with Less Logging

Abstract

Currently, the main threats of network security are coming from hacker intrusion, deny of service (DoS), computer virus, worm, spam, malicious code and sniffer because there are many weaknesses in the original design of IPv4. One is that attackers could send IP spoofing packets which is he wants to attack. That is the attackers modify the IP from the true one to another on the IP field. However, it is hard to trace the source of attacks from victims. In this paper, we will propose a method that reduces the storage of the router and trace the attack source by a single packet. According to the experimental results, we can prove that it works well.

A survey on existing IP trace back mechanisms and their comparisons

“…In the connection of dos / DDoS attack, the victimized people could settle on utilization of the accepted ITrace messages will build the strike ways and eventually recognize the attackers [5]. Since every ITrace message best convey particular case alternately two joins of the whole path, those victimized person will must reconstruct the path.…”

“…But it could track the network traffic to a certain number of packets due to its probabilistic nature. In packet logging, the IP packet is logged meaning the packets which are outgoing from the router have their details scanned at and through each router it passes [5]. Usually, packet logging was thought to be impractical due to lot of reasons one of which being the enormous storage space for packet logs.…”

“…The intermediate routers marks those IP packets with extra data so that the victimized person could utilization them on focus the strike way [7]. Methodologies recommended incorporate hub append, hub testing Furthermore edge testing [5]. Those hub annex component may be comparative of the IP record course choice, in that those addresses from claiming progressive routers traversed.…”

“…Due to the slight complexity being cropped here there were two other researchers who are Song and Perrig who were able to transform the packet marking, the participate in the concomitant trace back intention: rather than of encoding the IP address interleaved at hand a botch, they counsel encoding the IP approach devote into an 11 bit hash play the part mess up and prove a 5 bit hop count, both stored in the 16-bit hint Cataloguing range (fragment ID field). This is based on the commemoration meander a 5-bit hop count (32 max hops) is satisfying for beside about Internet routes [5]. Goad, they counsel become absent-minded yoke alternative hashing functions be hand-medown accordingly stroll the play of the routers in the markings backside be dishonest.…”

“…Over addition, those ITrace-CP message if be sent following those relating IP bundle [10].To start on a higher note now we focus on packet marking procedures, Probabilistic packet marking is one procedures of the IP trace back to find out the attacker system in the network. There are other approaches towards the IP trace back which are divided into the categories asi) Traffic Monitoring ii) Packet Monitoring These play a major role in the finding the source of the packet which was behind the attack and also could be modified towards finding the location of the attacker [2] [5]. Well the question what arises is if the attacker is using a VPN (Virtual Private Network) to hide his credentials and go underneath the network and perform the attack?…”