Subliminal Traceroute in TCP/IP

We introduce a technique for tracing a class of “man in the middle” TCP spoofing attacks. The technique works by embedding a traceroute-like mechanism, which we call subliminal traceroute (ST), in the acknowledgment stream of an active TCP connection. We consider the design considerations of ST and show that the attacker can take an active role to defeat our method. We conclude by suggesting future work on ST that may make it more difficult to defeat.