AN IP TRACEBACK SCHEME FOR SECURING NETWORKS FROM IP SPOOFERS

Computer Science and Engineering

In computer networking, IP address spoofing or IP spoofing is the creation of Internet Protocol (IP) packets with a forged source IP address, with the purpose of concealing the identity of the sender or impersonating another computing system. The basic protocol for sending data in the Internet network and many other networks is the Internet Protocol ("IP"). The header of each IP packet contains the numerical source and destination address of the packet. The source address is normally the address that the packet was sent from. By forging the header so it contains a different address, an attacker can make it appear that the packet was sent by a different machine. So that the IP Spoofing comes into place. Cloud services offer better options for practical deployment of an IP traceback system. We first present novel cloud-based traceback architecture. We have proposed a novel solution, named Man in the Middle Attack () to avoid the challenges in operation. To capture the origins of IP spoofing traffic is of great importance. As long as the real locations of spoofers are not disclosed, they cannot be deterred from launching further attacks. Even just approaching the spoofers, for example, determining the ASes or networks they reside in, attackers can be located in a smaller area, and filters can be placed closer to the attacker before attacking traffic get aggregated. The last but not the least, identifying the origins of spoofing traffic can help build a reputation system for ASes, which would be helpful to push the corresponding ISPs to verify IP source address. The proposed solution ensures that the entity requesting for traceback service is an actual recipient of the packets to be traced.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.