Practical Network Support for IP traceback by Savage

Practical Network Support for IP traceback by Savage, Wetherall, Karlin, and Anderson Presenter: Vangelis Markatos 1

What is the problem? • DOS attacks • DOS attackers flood their victims with packets (TCP SYN, ICMP, etc. ) • We would like to be able to find the attackers • Report them to the Police • Block them from the Internet 2

Solution #1: Source IP address • Look at the “source address” field of the IP packet • Problem: attackers lie: they use a spoofed source address 3

Solution #2: The helpline • Call the helpline of the ISP asking where do these packets come from • … • … • They do not know… How would they know? 4

Solution #3: Logging • Log all packets at all routers and ask them if they have seen your attack packets • It works!!! • BUT: • Too much data … space? Disk bandwidth? • One 100 Gbps line generates 40 Tbytes per hour… 5

Solution #4: Control flooding • Send too much data (i. e. flood) each upstream link and see how it affects the attack traffic. • If flooding the link reduces the attack traffic, then the attack is coming from that link • Noisy result… • You effectively Do. S attack all upstream links… 6

The schema Single host under attack or a network border device (e. g. firewall, intrusion detection system) Potential attack origin

Solution #5: This paper • Use “traceback” • Each router on the path should “stamp” the packet • All routers should stamp the packet • The one router after the other • The victim will receive a packet that contains the path the packet followed 8

So? • Brilliant idea! The packet will contain the path it followed on the Internet • Can the attacker change the path? • No! The path downstream of the attacker can not be changed by the attacker • So, what is hard about this solution? • … • WHERE are you going to store the path? • In the payload? Are you going to overwrite the payload? • In the header? Are you going to overwrite the header? 9

In the header? Where? • Destination Address? • How will it reach its destination? • Source Address? • If it is a legit packet, how will the response go back? • Checksum? • The error detection code? • TTL? • They will loop for ever… • Identification? (from fragmentation) • Maybe… well … yes! 10

OK – we store the stamps in the Identification Field • But this is just 16 bits… • How can we fit an entire path in 16 bits? • We can only fit (at best) one stamp • Just one stamp – not an entire path… • OK • We will describe algorithms that re-construct a path from a single stamp… 11

Node sampling • 12

Node sampling • 13

Idea! • • • This is a Do. S attack! We receive millions of packets!!!! Yeaaaa! 50% of them will have the stamp of R 1 25% of them will have the stamp of R 2 12. 5% of them will have the stamp of R 3 OR the 50% stamps that are the same are the first router the 25% stamps that are the same are the second router the 12. 5% stamps that are the same are third router… 14

Problems • DDo. S attack • What if all A 1, A 2, A 3 attack at the same time? • We will have several paths to the attacker(s) • How do we connect nodes to paths? 15

Idea: Edge sampling! • Sample edges – not nodes • Compute the distance from the victim as well Sample Write the left node of the edge Write the right node of the edge Increment distance (in all cases) 16

Edge Sampling • Can the attacker produce packets with fake edges? • Yes! Some of them are bound to get through • BUT • They will have a high “distance” • So, if we see (x, y, 10) and (x, y, 11) we keep the first 17

How about space? • Edge sampling needs three things: • Start node, end node, distance • 32 bits, 8 bits = 72 bits • BUT we only have the Identification • 16 bits • How can we fit 72 bits in 16 bits? 18

Space – the final frontier… • Reduce the bits of the edge (start, end, bits) as follows: • Send the (start XOR end, bits): (32 bits, 8 bits) a total of 40 bits • WHAT? ? • If edge (R 1, V) is sampled R 1 will deliver (V XOR R 1) • Recover R 1 as follows: (V XOR R 1) XOR V = R 1 • “V” knows itself – it will just find • If edge (R 2, R 1) is sampled R 2 will deliver (R 2 XOR R 1) • Recover R 2 as follows: (R 2 XOR R 1) XOR R 1 = R 2 • V just computed R 1 – just above 19

Space – the final frontier #2 • OK – we just need 40 bits. Still… • How can you fit 40 bits in 16? • Well use 8 of the 16 bits for the distance • And… • The rest 8 for the address • Still… • How can you fit a 32 -bit-long address in 8 bits? 20

Problem: Fit 32 bits in 8 bits • Solution #1: Compress • Ha ha ha!!!! • Solution #2: Go home – ignore it – life is too short to think about these things • Ha ha ha!!! • Solution #3 • • • This is a Do. S attack. We receive millions of packets Can we “break” the 32 bits into 8 -bit-long pieces? Each packet will have a different piece It works fine as long as we can re-assemble the pieces… Wow!!!! But, • How are you going to distinguish the pieces of R 2 from the pieces of R 3? • Easy! R 2 is distance 2, and R 3 is distance 3 • How are you going to distinguish the pieces of R 3 from the pieces of R 4? • They are both at distance 3 …. 21

Reassembling the pieces… • Combine the Address with a Hash of it (for correctness) • If the address is sampled, a fragment is chosen randomly and send to the destination 22

Reassembling the fragments • The victim will have a bunch a fragments. • How does it know how to reassemble them? • Each fragment is labeled by its offset • So we have 5 useful bits – not 8? • …. Right… 23

Reassemble the fragments • Collect all fragments of a given distance • Put them in order of their offset • If the Hash matches the reassembly was successful 24

Summary • Find the path of the Do. S attack • Each router should flip a coin and put a stamp in each packet • The stamp could be • the router id OR • the edge that connects this router and the next one • Fitting the stamp in 16 bits turned out to be a challenge… 25