Apparatus and method for providing a connecition traceback using tcp connection hijacking

The connection base station apparatus and tracking method is disclosed. Packet identifying unit to identify the response packet to be output to the acknowledgment for a packet attack. And a marker insert is a response packet transmitted by inserting predetermined marker to the tracking station the position of the attacker system. Sequence management unit stores the sequence information of the changed response packet to the insertion of the marker with the sequence information before the change and changes the sequence information of the received packet when it receives a predetermined packet to the acknowledgment for the reply packet on the basis of the stored sequence information transfer do. Thus, maintaining the TCP connection between the attacker and the victim machine and system can be traced back to the location of the attackers system.