Network Support For IP Traceback Stefan Savage David

Network Support For IP Traceback Stefan Savage, David Wetherall, Anna Karlin and Tom Anderson University of Washington- Seattle, WA Slides originally by. Teng Fei - Umass April, 2002 1

The Problem • Denial of Service (Do. S) attack • • Remotely consume resource of server or network Increase in number and frequency Simple to implement Do. S attacks are difficult to trace: • Indirection • • Attacking packets sent from slave machines, which under the control of a remote master machine Spoof of IP source addresses • Disguise their location using incorrect IP addresses, hence the true origin is lost 2

Packet Marking Traceback • Mark packets with router address • deterministically or probabilistically • Trace attack using marked packets • Pros • Require no cooperation with ISPs • Does not cause heavy network overhead • Can trace attack “post mortem” 3

Multiple Attackers attack origin A 2 A 1 R 5 A 3 R 7 R 6 R 3 R 4 R 2 victim R 1 V 4

Exact Traceback Problem A 2 A 1 R 5 A 3 R 7 R 6 R 3 exact traceback R 6, R 3, R 2, R 1 R 4 R 2 R 1 attack path V 5

Approximate Traceback Problem A 2 A 1 R 5 A 3 R 7 R 6 R 3 approx. traceback R 5, R 6, R 3, R 2, R 1 R 4 R 2 R 1 V 6

Methodology • I. Marking procedure • • by routers add information to packets • II. Path reconstruction procedure • • • by victim use information in marked packets convergence time: # of packets to reconstruct the attack path 7

Basic Marking Algorithms • I. Node Append • II. Node Sampling • III. Edge Sampling 8

I. Node Append • Append address of each node to the end of the packet • Complete, ordered list of routers attack path original packet router list 9

I. Node Append • Pros • complete, ordered attack path • converge quickly (single packet) • Cons • infeasibly high router overhead • attacks can create false path information 10

II. Node Sampling • Reserve node file in packet header • Router write address in node field with probability p • Reconstruct path using relative # of node samples • Only require additional write, checksum update 11

II. Node Sampling R 1 R 2 R 3 12

II. Node Sampling R 1 R 2 R 3 13

II. Node Sampling R 1 R 2 R 3 14

II. Node Sampling R 3 R 1 R 2 R 3 15

II. Node Sampling • Cons: • Slow convergence • need many packets • usually order of 10, 000 - 100, 000 • Can not trace multiple attackers ▪ 16

III. Edge Sampling • Edge represent routers at each end of the link R 1 R 2 • Store edges instead of nodes • start and end addresses of edge routers • distance from edge to victim 17

III. Edge Sampling • A router writes its own address in the start field, and 0 into the distance field • Distance field of 0 means the packet is already marked • router writes its own address in the end address field and increase the distance field by 1 • Other routers may then reset these fields. Otherwise, the distance field is incremented 18

III. Edge Sampling R 1 #1 #1 R 2 R 3 19

III. Edge Sampling R 1 #1 R 1 0 R 2 R 3 20

III. Edge Sampling R 1 R 2 1 R 3 21

III. Edge Sampling R 1 R 2 2 R 3 22

Path Reconstuction • Consider G is a graph with root v • Insert tuples (start, end, distance) into G • Remove any edge (x, y, d) with d != distance from x to v in G • Extract path from G 23

III. Edge Sampling • Pros • Converge much faster than node sampling • Efficiently discern multiple attacks • Cons • Space: requires additional space in the IP header- 72 bits of space in every IP packet (2 x 32 bit IP address and 8 bit for distance) • Compatibility ▪ 24

Encoding Issue • Overload the IP identification field • • Decreases the space requirement • • store the XOR of the edge addresses (edge-id)- B XOR A XOR B = A Pros: • • used for fragmentation Reduced space Cons: • Increases reconstruction time 25

Marking With XOR attack path b a c d v resulting XOR edges a XOR b b XOR c c XOR d d 26

Reconstructing With XOR d c XOR d reconstructed path c b XOR c b a XOR b a

Subdividing Edge-id • Reduce per packet space more by dividing the edge-id (XORed address) into k nonoverlapping packets, and store only 1 of them • Need offset of fragment 28

Creating Unique Edge-ids • Problem: Edge-id fragments are not unique • with multiple attackers, multiple edge fragments with the same offset and distance • Solutoin: Bit-interleave hash code with IP address 29

Creating Unique Edge-ids Address 0000. . . 1111 Hash(Address) 0011… 1100 Bit-interleave 00000101. . . 11111010 0 k-1 send k fragments into network 30

Candidate Edge-ids • Combine all permutations of fragments at each distance with disjoint offset values • Check that the hash matches hash of the address 31

Construction Candidate Edges k-1 0 00000101. . . 11111010 0000. . . 1111 Address? No, reject 0011… 1100 Hash(Address)? =? 0011… 1100 Hash(Address? ) 32 Yes, correct address

Encoding Edge Fragments • Overload the 16 -bit identification field • used to differentiate IP fragments 33