Adjusted Probabilistic Packet Marking for IP Traceback

Transcription

1 Ajuste Probabilistic Packet Marking for IP Traceback Tao Peng, Christopher Leckie, an Kotagiri Ramamohanarao 2 ARC Special Research Center for Ultra-Broaban Information Networks Department of Electrical an Electronic Engineering The University of Melbourne Victoria 300, Australia {t.peng,c.leckie}@ee.mu.oz.au 2 Department of Computer Science an Software Engineering The University of Melbourne Victoria 300, Australia rao@cs.mu.oz.au Abstract. Distribute enial-of-service attack is one of the greatest threats to the Internet toay. One of the biggest ifficulties in efening against this attack is that attackers always use incorrect, or spoofe IP source aresses to isguise their true origin. In this paper, we present a packet marking algorithm which allows the victim to traceback the approximate origin of spoofe IP packets. The ifference between this proposal an previous proposals lies in two points. First, we evelop three techniques to ajust the packet marking probability, which significantly reuces the number of packets neee by the victim to reconstruct the attack path. Secon, we give a etaile analysis of the vulnerabilities of probabilistic packet marking, an escribe a version of our ajuste probabilistic packet marking scheme whose performance is not affecte by spoofe marking fiels. Introuction Distribute enial-of-service (DDoS)attacks have become a major threat to the Internet [0]. At the same time, DDoS is extremely ifficult to efen [6]. The reason lies in the fact that the attackers use incorrect ( spoofe )IP aresses in the attacking packets an therefore isguise the real origin of the attacks. This has mae it very ifficult or impossible to traceback the source of attacking IP packets. A number of recent stuies have approache the problem of IP packet traceback by Probabilistic Packet Marking (PPM)[5] [7]. It is assume that the attacking packets are much more frequent than the normal packets. The main iea is to let every router mark packets probabilistically an let the victim reconstruct the attack path from the marke packet. All of the probabilistic marking algorithms try to overloa the marking information into the 6 bit ientification fiel in the IP packet heaer, which is selom use [5] [8]. A major issue with E. Gregori et al. (Es.): NETWORKING 2002, LNCS 2345, pp , c Springer-Verlag Berlin Heielberg 2002

2 698 T. Peng, C. Leckie, an K. Ramamohanarao existing probabilistic marking schemes is that they use a fixe marking probability, which means that there is a greatly reuce probability of getting packets from routers which are far away from the victim. Consequently the number of packets neee to reconstruct the attack path epens on the number of packets which are marke by the furthest router in the attack path. If we can increase the marking probability for the routers which are far away from the victim, then we nee less packets to reconstruct the attack path. A potential problem with packet marking is that the attacker can forge the marking fiel. The authenticity of the marking fiel is the biggest challenge for Probabilistic Packet Marking, which is iscusse in [3]. Although Song an Perrig [7] have propose a scheme for router authentication, it is still har to implement an there are still some chances for the attacker to spoof the marking fiel. However, if we can let the routers mark all the packets when they first enter the network, then there is no way for the attacker to use the spoofe marking fiel to ecoy the victim. In this paper, we make two contributions to the technique of Probabilistic Packet Marking. First, we have evelope three techniques for ajusting the probability use by routers to mark packets, in orer to reuce the number of packets neee by the victim to reconstruct the attack path. Secon, we give a etaile analysis of the vulnerabilities of PPM, an escribe a version of our ajuste probabilistic packet marking scheme whose performance is not affecte by spoofe marking fiels. We emonstrate the benefits of our approach with an analytical moel as well as proviing an experimental evaluation using simulate packet traces. The paper is organize as follows. We present a brief backgroun to this problem an highlight the main challenges of IP marking in Section 2. Section 3 introuces our Ajuste Probabilistic Marking Algorithm an shows a theoretical analysis. Simulation results of all these three techniques are provie in Section 4. From the analysis an simulation results, we can see that our Ajuste Probabilistic Marking Algorithm is more efficient an secure than the previous marking schemes. We iscuss some practical issues in Section 5 an the relate work is given in Section 6. Finally we conclue in Section 7. 2 Backgroun on Probabilistic Packet Marking (PPM) Once an attack has been etecte, an ieal response woul be to block the attack traffic at its source. Unfortunately, there is no easy way to track IP traffic to its source. This is ue to two features of the IP protocol. The first feature is the ease with which IP source aresses can be forge. The secon feature is the stateless nature of IP routing, where routers normally know only the next hop for forwaring a packet, rather than the complete en-to-en route taken by each packet. This esign ecision has given the Internet enormous efficiency an scalability, albeit at the cost of traceability. In orer to aress this limitation, Probabilistic Packet Marking (PPM)has been propose to support IP traceability.

3 Ajuste Probabilistic Packet Marking for IP Traceback Definitions The main iea of PPM is to let routers mark the packets with path information probabilistically an let the victim reconstruct the attack path using the marke packets. Denial-of-service attacks are only effective so long as they occupy the resources of the victim. As a result, most enial-of-service attacks are comprise of thousans or millions of packets. PPM is base on the assumption that when we mark each packet with only a small probability then the victim will receive sufficient packets to reconstruct the attack path. The network can be viewe as a irecte graph G =(V,E)where V is the set of noes an E is the set of eges. V can be further partitione into en systems (leaf noes)an routers (internal noes). The eges enote physical links between elements in V. Let S V enote the set of attackers an let t V/S enote the victim. We will first consier the case when S = (single-source attack)an treat the istribute DoS attack case separately. We assume that routes are fixe, an that the attack path A = (s, v,v 2,..., v,t)is comprise of routers (or hops)an has path length [3]. Let N enote the number of packets sent from s to t. A packet x is assume to have a marking fiel where the ientity of a link (v, v ) E traverse can be inscribe. A packet travels on the attack path sequentially. At a hop v i {v,..., v }, packet x is marke with the ege value (v i,v i ),i =,...,,with probability p. As we seen in Fig., packet is marke with ege value (v,v 2 ) an istance 2; packet 2 is marke with ege value (v 2,v 3 )an istance. When t receives two packets it can reconstruct the attack path (v,v 2,v 3 ). Each router marks a packet with probability p. When the router ecies to mark a packet, it writes its own IP aress into the ege fiel an zero into the istance fiel. Otherwise, if the istance fiel is alreay zero, which means this packet has been marke by the previous router, it processes the packet as follows: ()It combines its IP aress an the existing value in the ege fiel an writes the combine value into the ege fiel. (2)It increases the istance value by. Thus, the ege value contains both information from the previous router an the current router. Finally if the router oes not mark the packet, then it always increments the istance fiel. This istance fiel inicates the number of hops between the victim an the router that has marke the packet. The istance fiel shoul be upate using saturating aition, meaning the istance fiel is not allowe to wrap. When using this scheme, any packet written by the attacker will have a istance fiel greater than or equal to the real attack path. In contrast, a packet which is marke by the router shoul have a istance fiel which is less than the length of the path traverse from that router. Savage et al. propose a metho calle Fragment Marking Scheme (FMS)[5] to compress the IP aresses an recontruct the attack path. It is later improve by Song an Perrig[7]. Unless otherwise state, when we talk about PPM in the rest of this paper, we are referring to Song an Perrig s version of PPM.

4 700 T. Peng, C. Leckie, an K. Ramamohanarao v, v 2 2 packet S v v v 2 3 t v, v 2 3 packet 2 Fig.. Probabilistic Packet Marking 2.2 Limitation of Previous PPM Schemes Our aim is to minimize the time require to reconstruct the attack path. This epens on the time it takes to receive packets that have been marke by each router on the attack path. This in turn epens on the choice of the marking probability p. In this section, we moel the performance of PPM in terms of p, an highlight the limitation of using a fixe marking probability. Definition. Let α i enote the probability that packet arriving at the victim is lastly marke at noe v i but nowhere after v i. For a uniform marking probability, α i =Pr{x =(v i,v i )} = p( p) i (i =, 2,...,). Definition 2. Let α 0 enote the probability that a packet sent from the attacker reaches the victim without being marke at any of the routers. For a uniform marking probability, α 0 =( p). In orer to reconstruct the attack path as quickly as possible, the victim nees to receive a sample of packets marke by each router in the path. An unmarke packet provies no information to the victim. In fact, there is a risk that unmarke packets may contain misleaing information that has been spoofe by the attacker. Consequently, we want as many packets to be marke as possible. This implies that p shoul be large, so that α 0 is as small as possible. However, there is a penalty for making p too large. As p increases, there is a greater likelihoo that packets marke by routers close to the source will be overwritten by routers close to the victim. Note that α...α 2 α,soα is the smallest value. This is worst for packets marke by the first router after the source. So we nee to choose p such that α 0 is minimize an α is maximize. Accoring to the coupon collecting problem [8], for each attack path with routers (excluing the victim), an with marking probability p, the expecte number of packets neee to reconstruct the attack path is N() = ln()+o() p( p) [5]. We can show that N()is minimise when p =. Consequently, the number of packets neee to get one sample from each router is N f () ln()+o() ( ). This is the best result we can achieve for marking algorithms with a fixe probability. Our proposal is to reuce the total number of packets require N()by using a higher marking probability for routers close to the source. Ieally, we want to receive an equal number of packets marke by each router on the attack path, i.e. α i =/. In this case, the number of packets neee for reconstruction is N a () = ln(). The savings of this approach are N f () N a() =( ), which is greater than 2 for 2. Our aim has been to evelop a technique for ajusting the marking probability so that we can achieve the performance of N a ().

5 Ajuste Probabilistic Packet Marking for IP Traceback 70 3 Ajuste Probabilistic Packet Marking Schemes Accoring to the analysis in section 2, we propose that a router shoul ajust its packet marking probability base on its position in the attack path. However, the position of the router in the attack path is not known, since the position of the attacker is unknown. We nee to estimate this istance base on the available information. In this section, we propose 3 ifferent schemes for ajusting the marking probability base on the ifferent istance measures, 2 an 3. The efinition of these istances is shown in Fig. 2 s v v v t : istance from source to current router : istance from last router to mark packet to current router : istance from current router to estination Fig. 2. Definitions of ifferent istance measures 3. Number of Hops Traverse by Packet Let every router mark the packet with probability p ( )=/. The ieal case for packet marking is to receive packets marke by each router with equal probability α i =/, if the path length is. Let p ( )represent the marking probability of the router at istance from the source, where =, 2,...,. Then we obtain the following equations: α = p () =/ () α = p ( )[ p () ]=/ (2) α 2 = p ( 2)[ p ( )][ p () ]=/ (3) From equation we can get p () =/; from equation 2 we can get p ( )= /( ); from equation 3 we can get p ( 2)= /( 2). Accoringly, we can summarize the marking probability formula as p ( )=/. Then for the router at istance, α = ( ) ( + )... ( +2 ).... =. This means if each router marks the packet with the probability p ( )=/,we can receive the packets marke by each router with equal probability /, given the path length is. In orer to implement this marking scheme, we nee to know the istance measure. We propose to a an extra fiel in the IP option fiel. This fiel can be use to recor the number of hops ( )traverse by the packet. The efault value for this fiel is 0, an the router increases this value by every This equation can be simplifie as α =

6 702 T. Peng, C. Leckie, an K. Ramamohanarao time it forwars the packet. Every time the router gets the packet, it extracts the information from the option fiel an marks the packet with probability /. In orer to prevent the attacker from spoofing this fiel, we can use the encryption schemes which are iscusse in [7]. 3.2 Number of Hops Traverse Since the Packet Was Last Marke ( 2 ) In the original Probabilistic Packet Marking (PPM)scheme [5], there are three parts in the marking fiel. One part is calle the istance fiel ( 2 ), which is use to hol the istance information from last router to mark the packet to the current router. We enote 2 = 0 for routers next to each other. Let each router mark the packet accoring to the formula: 2( 2+). Since the larger the 2 value, the higher the likelihoo that it will be overwritten. Thus, we believe we shoul use a low marking probability for the packets with high 2 value. Let us now illustrate the erivation of this formula by consiering an example when the attack path length is 3. The router marks the packet which has a istance value 2 in the marking fiel with a probability p 2 ( 2 ). We assume the routers mark each packet when it first enters the network. So when the packet passes the first router, the 2 value will be set to 0. By analyzing all the possibilities of the 2 value when the packets traverse the attack path, we can erive expression for α i,i=, 2,...,. Using these equations, we can fin optimal marking probabilities for α,α 2,α 3. However, the equations become more complicate as the path length increases, we consequently propose that the general marking probability shoul be p 2 ( 2 )= 2( 2+), which has been shown through experiments to have the best performance. Since there are 5 bits in the marking fiel to hol the information in the existing probabilistic marking scheme [5] [7], we only nee to extract this information from the marking fiel an mark the packet accoring to the formula p 2 ( 2 )= 2(. 2+) 3.3 Number of Hops from Current Router to Destination ( 3 ) If we can get the istance of the current router to the estination ( 3 ), we can mark each packet with a probability p 3 ( 3 )=/(c+ 3 )where c is a constant, an then we can receive packets marke by each router with a probability of /c. Accoring to the marking scheme, we can have α 3 = c+ 3 ( c )...( 3+2 c )( c )=. In orer to make this scheme work, we have to make sure c + 3 > 0. Since most path lengths in the Internet are boune by 30 [4] [] [9], we can take c = 30 for safety. So if we mark with probability p 3 ( 3 )=/(3 3 ), we can make sure we can receive the packets marke by each router with probability /30. We rely on the routing protocol to provie us with the istance measure 3. Current Internet routing protocols are estination-base an every time the router forwars the packet, it will look at the routing table to fin the next c+ 3 c 3+ c 2 c c c c = c

7 Ajuste Probabilistic Packet Marking for IP Traceback 703 hop to the estination. Internet protocols provie us with a measure of the number of hops to each estination, which can be store in the routing table as a measure of istance 3. When the router starts to route the packet, it can extract the istance information 3 from the routing table an then mark the packet accoring to the formula p 3 ( 3 )=/(3 3 ). 3.4 Summary We can summarize each marking scheme in term of its performance an practicality. Marking scheme : p ( )=/ can achieve the ieal marking performance. With this marking scheme, we can receive the packets marke by each router with equal probability for path length. Furthermore, every packet is marke uner this scheme, an the attacker has no chance to spoof the marking fiel. However, this scheme requires a special hop count fiel an there is a risk that this fiel can be spoofe by the attacker. In orer to make this scheme work, we nee a strong authentication scheme which can stop the attacker from spoofing, e.g. [7]. Marking scheme 2: p 2 ( 2 )= 2( 2+) uses the istance fiel that is part of the packet marking scheme. This scheme can achieve a performance which is close to the optimal performance. In orer to make this scheme work, we nee to make sure the istance value in the marking fiel is trustable. One possibility is to let the routers mark all the packets when they first enter the network, then the attackers have no way to spoof the istance value. However, this is only practical if we control the ingress routers to our network, an thus is effectively the same as a technique calle ingress filtering [9]. Marking scheme 3: uses information from the routing protocol an can achieve better results than using the uniform marking probability. Since the information is from the routing protocol, it can not be manipulate by an attacker. So scheme 3 is the safest an most practical scheme. 4Evaluation Our aim is to compare the performance of each scheme to PPM. Our comparison is base on the number of packets neee to reconstruct an attack path for a range of simulate attacks. 4. Methoology We simulate attacks from ifferent istances using the methoology in [7]. The network topology is base on a real traceroute ataset obtaine from Lucent Bell Labs []. In our simulation, we vary the attack path from to 30 hops an conuct 000 ranom trials at each path length value. We measure the

8 704 T. Peng, C. Leckie, an K. Ramamohanarao number of packets require to reconstruct the attack path using our schemes, an compare this to the number of packets require by PPM [7], where our implementation of PPM use a threshol of M=5 as efine in [7]. We varie the uniform marking probability of PPM using the values p =0.0, 0.04, an 0.. Note that p =0.04 is recommene as the optimum choice for PPM [5]. 4.2 Results The performance of schemes to 3 are shown in Fig. 3. Schemes an 2 perform the best, outperforming PPM for all values of p teste. However, these results assume that the istance fiel has not been tampere with. Scheme 3 is the most practical, since its istance measure cannot be tampere with by the attacker. Scheme 3 outperforme PPM with p =0.0 an Although PPM with p =0. outperforms scheme 3 for small hop counts, scheme 3 performs far better when the attack path is large. Scheme 3 outperforms scheme 2 when path length is 20 or higher as shown in Fig. 3. This is because as the path length increases, scheme 3 approaches optimum performance while scheme 2 cannot achieve the optimum performance as we iscusse in Section 3.2. Furthermore, scheme an scheme 3 converge when the path length equals 30 because c equals the path length, which makes p 3 ( 3 )equivalent to p ( ) The number of packets neee for reconstruction Scheme Scheme 2 Scheme 3 p=0.0 p=0.04 p= Path Length Fig. 3. Scheme,2,3 compare with uniform marking probability

9 Ajuste Probabilistic Packet Marking for IP Traceback Discussion 5. Distribute Denial-of-Service Attacks During a istribute enial-of-service attack, there are many attacking sources. We have foun that the number of packets neee for reconstruction increases linearly with the number of attackers. So it will become very har to verify all the attacking sources uring a DDoS attack. Thus, our metho to reuce the number of packets neee for reconstruction becomes extremely important to improve the reconstruction efficiency. 5.2 Spoofing the Marking Fiel By spoofing the marking fiel, it is possible for attackers to make the attack appear as though it has come from a more istant source, e.g. a false source s f as shown in Fig. 4. However, the attacker cannot change the marking of routers between it an the victim, e.g., v to v 3. Consequently, we can always reconstruct the path to the attacker, although we may also reconstruct a false sub-path at the start of the true path, e.g., v f to v f3. s f s v f v f v f v v v t Fig. 4. Effect of Spoofing the Marking Fiel (Fake sub-path: v f to v f3,true path: v to v 3) If we are unable to authenticate the marking fiel, then this false sub-path can affect the performance of our first two schemes. This is because istance measures an 2 will be inflate by the false sub-path, thus ecreasing the packet marking probability of routers in the true attack path. However, our thir scheme is unaffecte by the actions of the attacker. This is because 3 is erive from information in the routing table of each router, an the estination fiel. The attacker cannot fake the estination fiel without efeating the purpose of the attack, an the attacker cannot manipulate the contents of the routing tables in the routers. Thus, the performance of our thir scheme is secure against manipulation by the attacker. 6 Relate Work Burch an Cheswick [3] propose a link-testing traceback technique. It infers the attack path by flooing the links with large bursts of traffic an observing how this perturbs the attack traffic. This scheme requires consierable knowlege of network topology an the ability to generate huge traffic in any network

10 706 T. Peng, C. Leckie, an K. Ramamohanarao links. Mahajan et al. [2] provie a scheme in which routers learn a congestion signature to tell goo traffic from ba traffic. The router then filters the ba traffic accoring to this signature. Furthermore, a pushback scheme is given to let the router ask its ajacent routers to filter the ba traffic at an earlier stage. This scheme is effective for some types of DDoS attacks but it nees a narrow an accurate congestion signature to make sure the ba traffic is filtere while the goo traffic is not affecte. Bellovin [2] propose an ICMP traceback scheme to let router generate ICMP packets to the estination containing the aress of the router with a low probability. For a significant traffic flow, the estination can graually reconstruct the route that was taken by the packets in the flow. ICMP packets are often treate with a low priority by routers to reuce the aitional traffic, which unermines the effectiveness of the scheme. This scheme is later extene by Wu et al. [20]. An alternative approach is to mark the packets themselves. Savage et al. [5] escribe a scheme for routers to probabilistically mark packets. They propose using the ientification fiel of the IP heaer, which is normally use to control fragmentation. They point out that IP fragmentation is selom use in practice. While their approach overcomes many of the limitations of the ICMP traceback proposal, there are some security problems when the attackers fake the marking fiel. Song et al. [7] propose an enhance scheme of probabilistic packet marking an also set up a scheme for router authentication. However, the authentication scheme is complex to implement. Dean et al. [7] propose an alternative marking scheme using noisy polynomial reconstruction. This scheme is backwars compatible, an incrementally eployable compare with the former proposals. Unfortunately their scheme is very vulnerable to fake markings put in the packets by the attackers. Furthermore, the number of packets neee to reconstruct the attack path is quaratic to the number of attackers. Snoeren et al. [6] propose a scheme to let routers store a recor of every packet passing through the router, so that the router can then trace back the origin of the packet by using the history in the router. Although they escribe a smart scheme to compress the storage, it is still a huge overhea for the router to implement this scheme, especially with the increasing network spee. Park an Lee [4] propose to put istribute filters in the routers an filter the packets accoring to the network topology. This scheme can stop the spoofe traffic at an early stage. However, in orer to place the filters effectively, it nees to know the topology of the Internet an routing policy between Autonomous Systems, which is har to achieve in the expaning Internet. In summary, every marking scheme uses a fixe marking probability which will result in a small number of packets marke by the more istant routers when all the packets arrive at the victim. In contrast, we have evelope several schemes that solve this problem by ajusting the marking probability in each router, which significantly reuces the number of packets require to reconstruct the attack path. Furthermore, no one has set up a scheme to completely solve the security problem that the attacker can fake the marking fiel. However, our thir marking scheme oes not use the contents of the marking fiel to ajust the marking probability, an thus cannot be manipulate by the attacker while at the same time requiring fewer packets to trace the packet.

11 7 Conclusion Ajuste Probabilistic Packet Marking for IP Traceback 707 In this paper, we make the following two contributions to Probabilistic Packet Marking (PPM). First, we evelope three techniques to ajust the marking probability use by each router so that the victim receives packets marke by each router with equal probability. Scheme is to let the IP packet carry a message to inform the router how far the packet has travele. Scheme 2 is to use the istance value of the marking fiel in the IP packet. Scheme 3 is to get the istance between the router an estination from the routing table. Both scheme an scheme 2 nee authentication to prevent the attacker from spoofing the require information. Scheme 3 is the most practical one an can improve the reconstruction efficiency compare with the optimal uniform marking probability (p = 0.04). By implementing this scheme, we can substantially reuce the number of packets neee to reconstruct the attack path in comparison to PPM. Our secon contribution is that we give a etaile analysis of the vulnerability of PPM, an escribe a version of our ajuste probabilistic packet marking scheme whose performance is not affecte by the vulnerability cause by spoofe marking fiels. Acknowlegment. We woul like to thank the AT&T Internet Mapping Project for making available their traceroute ata an the anonymous reviewers for their helpful comments. References. Skitter Analysis. Cooperative association for internet ata analysis, http: // 2. S. Bellovin. The icmp traceback message. Internet Draft,IETF, March raftbellovin-itrace-05.txt (work in progress). smb. 3. Hal Burch an Bill Cheswick. Tracing anonymous packets to their approximate source. In Proceeings of the 4th Systems Aministration Conference, New Orleans, Louisiana, U.S.A., December R.L. Carter an M.E. Crovella. Dynamic server selection using ynamic path characterization in wie-area networks. In Proceeings of the 997 IEEE INFOCOM Conference, Kobe,Japan, April K. Claffy an S. McCreary. Sample measurements from june 999 to ecember 999 at the ames inter-exchange point. Personal Communication, January Computer emergency response team. cert avisory ca : Denial-of-service evelopments, Drew Dean, Matt Franklin, an Aam Stubblefiel. An algebraic approach to ip traceback. In Network an Distribute System Security Symposium, NDSS 0, Feburary W. Feller. An Introuction to Probability Theory an Its Applications(2n eition), volume. Wiley an Sons, P. Ferguson an D. Senie. Network ingress filtering: Defeating enial of service attacks which employ IP source aress spoofing. RFC2267,IETF, January John D. Howar. An Analysis of Security Incients on the Internet. PhD thesis, Carnegie Mellon University, 998.

12 708 T. Peng, C. Leckie, an K. Ramamohanarao. Lucent Lab. Internet mapping, labs.com/who/ches/map/bs-/inex.html. 2. Ratul Mahajan, Steven M. Bellovin, Sally Floy, John Ioanniis, Vern Paxson, an Scott Shenker. Controlling high banwith aggregates in the network. Technical report, AT&T Center for Internet Research at ICSI (ACIRI) an AT&T Labs Research, February K. Park an H. Lee. On the effectiveness of probabilistic packet marking for ip traceback uner enial of service attack. In Proceeings of IEEE INFOCOM 200, Kihong Park an Heejo Lee. On the effectiveness of router-base packet filtering for istribute os attack prevention in power-law internets. In Proceeings of the 200 ACM SIGCOMM Conference, San Diego, California, U.S.A., August Stefan Savage, Davi Wetherall, Anna Karlin, an Tom Anerson. Practical network support for ip traceback. In Proceeings of the 2000 ACM SIGCOMM Conference, August Alex C. Snoeren, Craig Partrige, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, an W. Timothy Strayer. Hash-base ip traceback. In Proceeings of the 200 ACM SIGCOMM Conference, San Diego, California, U.S.A., August Dawn X. Song an Arian Perrig. Avance an authenticate marking schemes for ip traceback. In Proceeings of IEEE INFOCOM 200, perrig/projects/iptraceback/tr-iptrace.ps.gz. 8. I. Stoica an H. Zhang. Proviing guarantee services without per flow management. In Proceeings of the 999 ACM SIGCOMM Conference, Boston,MA, August W. Theilmann an K. Rothermel. Dynamic istance maps of the internet. In Proceeings of the 2000 IEEE INFOCOM Conference, Tel Aviv, Israel, March S. Felix Wu, Lixia Zhang, Dan Massey, an Allison Mankin. Intension-Driven ICMP Trace-Back. Interner Draft,IETF, February 200. raft-wu-itrace-intension- 00.txt(work in progress).