Using Probing Packets to Recover the Incomplete IP Traceback

Abstract

An enhancement of probability packet marking (PPM) used to trace back the denial-of-service attacker is proposed. Through sending probing packets, the proposed scheme is used to recover missing attacking paths, resulting from successive non-PPM routers, which do not support PPM scheme along the attack path. Furthermore, according to the proposed scheme, the probing packet with IP record routing or loose source routing can detect consecutive non-PPM routers and help to recover lost paths because of non-PPM routers in a row. Especially, this scheme with the loosen source routing algorithm can record all traveled routers' IP addresses into probing packet's IP header