IP Traceback in a Switched Ethernet Network

IP traceback is the generic term given to systems that allow the tracing of IP packets back to their originating machine. A common shortcoming shared by existing traceback proposals is that they are able to identify the source network, but not the source host. Our work extends the traceback process by allowing the tracing of frames within the originating network (once this has been identified) to identify the originating host. We extend the SPIE system (which operates at the IP routers) with auditing at the Ethernet switches. The Ethernet traffic visibility issue is resolved with the use of switch port mirroring. The MAC address table is used to establish causality between the source frame address and source switch port. Our work removes the requirement for a specific network topology, as is the case in other known solutions. We provide a prototype implementation and preliminary evaluation of this to establish the efficacy of our proposal. © 2007 University of Newcastle upon Tyne. Printed and published by the University of Newcastle upon Tyne, Computing Science, Claremont Tower, Claremont Road, Newcastle upon Tyne, NE1 7RU, England. Bibliographical details ANDREOU, M. S., VAN MOORSEL, A. IP Traceback in a Switched Ethernet Network [By] M. S. Andreou, A. van Moorsel. Newcastle upon Tyne: University of Newcastle upon Tyne: Computing Science, 2007. (University of Newcastle upon Tyne, Computing Science, Technical Report Series, No. CS-TR-1040)