Methods for Improving Performance on Packet Marking by Reducing Marking Duplicates

Probabilistic Packet Marking (PPM) is one of the methods on IP traceback. In this method, intermediate router embeds (i.e., marks) the address of itself into the header of the sampled packet. However, because the PPM does not have a mechanism to avoid overrides of marking information, there is a problem that it requires a lot of packets to reconstruct attack route. We previously proposed two marking schemes based on the history of marking. They can reconstruct the attack route with fewer packets than the original PPM, however, they still require some parameter tunings for obtaining the optimal performance. In this paper we analyze factors which cause override of marking information, and propose a new packet marking scheme to minimize the effect of packet overrides. Through simulation results, we show that our proposed method can reduce the required number of packets significantly to reconstruct the attack route without tuning of parameters compared with the original and history-based PPMs.