On the (in)Effectiveness of Probabilistic Marking for IP Traceback Under DDoS Attacks

Distributed denial-of-service attacks (DDoS) pose an immense threat to the Internet. The most studied solution is to let routers probabilistically mark packets with partial path information during packet forwarding, which is referred as Probabilistic Packet Marking (PPM). In this paper, we study the effect of simple attacker strategies to spoof the markings to impede victim's capacity to traceback. We show that random marking is sufficient to impede the victim from tracing the attackers. A simple enhancement based on IP path length distribution makes it harder for the victim. We hope that this analysis would help researchers to adapt the current PPM techniques accordingly to thwart the DDoS attacks.