IP Traceback by Packet Marking Method with Bloom Filters

IP traceback techniques are tracing methods which identify (candidate(s) of) the real sender of the packet(s) on the Internet, in which senders can freely spoof the source address written in the packet header. Many previous works have been done, but for postmortem tracing, some of them need a storage with large capacity and fast operation speed, and others need a number of packets to trace successfully. Aiming to diminish these shortcomings, we propose an IP traceback technique by a packet marking method with Bloom filters, which can trace a single packet postmortem without a large capacity storage. We evaluated the mean false positive rate of this method on a simple network topology, and find out that a single packet can be traced in a network with a few thousand routers if we use 16 bits for marking area and the false positive rate of one half is permitted.