Vulnerability analysis of IP traceback schemes

Distributed denial-of-service attacks pose a serious threat to today's Internet. To counter these attacks, many IP traceback schemes have been proposed; among them, distance-indexed probabilistic packet marking and its variants are attractive due to their stateless, low-overhead and incrementally-deployable design. However, some schemes may become vulnerable in practice, and the implication is yet to be quantified. In this paper, we first reveal these vulnerabilities. Sustained by efficacy analysis and numerical results, we then design several exploits that allow attackers to take full advantage of these vulnerabilities. We also examine the causes of these vulnerabilities as well as possible remedies, and discuss the distance-related buffer overflow in the context of network protocols.