PT: A Path Tracing and Filtering Mechanism to Defend against DDoS Attacks

Abstract

Distributed Denial of Service Attack continues to plague the world. Defense against the DDoS attacks gets complicated due to IP spoofing. We propose a new packet marking technique PT (called Path Tracer) which imprints the fingerprint of the path taken by attack traffic in each packet, thereby enabling the victim to identify the attack traffic on per packet basis even in presence of IP Spoofing. Our Packet Marking Technique has many unique features. It helps the victim to proactively filter out the attack packets based on the unique path mark. A single packet contains information about complete attack path. The marking algorithm is very simple. Our approach does not create overhead in the packet and it does not require any extra storage. Analysis of our scheme proves the effectiveness of PT in filtering out DDoS traffic while allowing the legitimate traffic to be processed normally.