Tracing Anonymous Packets to Their Approximate Source

By Hal Burch, Bill Cheswick. LiSA, 2000

589 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/e52258eec14f98af3e269c9205ed6a81ce088f09

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

SAVE: source address validity enforcement protocol (2002, unknown): “Logging and link testing can also be used for tracing [5][26].”
Pi: a path identification mechanism to defend against DDoS attacks (2003, background): “Burch and Cheswick present another scheme for path tracing [4].”
A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks (2013, background): “The second category is link testing mechanisms [67], [68] in which the traceback process usually starts from the router closest to the victim and iteratively tests its upstream links until it can be determined which link is used to carry the attacker’s traffic (i.”
Implementing Pushback: Router-Based Defense Against DDoS Attacks (2002, background): “The probability of keeping a packet is inversely proportional to its size, so that a constant fraction of the bandwidth, rather than of the packet count, is kept.”
On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack (2001, background): “In deterministic packet marking [15], the source of a traffic flow is recovered by employing tracing information inscribed in the packet.”
DDoS attacks and defense mechanisms: classification and state-of-the-art (2004, methodology): “A link-testing traceback technique has been proposed by Burch and Cheswick [64].”
Advanced and authenticated marking schemes for IP traceback (2001, background): “Burch and Chesw ick proposed controlled flooding [18].”
Change-point monitoring for the detection of DoS attacks (2004, methodology): “The controlled flooding technique developed by Burch and Cheswick [8] infers the attacking path by observing the impact of selectively exhausting some network links upon the victim.”
Controlling high bandwidth aggregates in the network (2002, background): “Another traceback proposal [ BC00 ] assumes that the victim has an approximate map of the Internet.”
SIFF: a stateless Internet flow filter to mitigate DDoS flooding attacks (2004, background): “Burch and Cheswick propose to use a limited form of DoS attack to probe which links are affected by an attack and can thus trace back to the origin [8].”
Practical network support for IP traceback (2000, background): “Burch and Cheswick mention the possibility of tracing flooding attacks by “marking” packets, either probabilistically or deterministically, with the addresses of the routers they traverse [6].”