When enough packets are received, the victim can reconstruct all of the edges the series of packets traversed (even in the presence of multiple attackers). Then, randomly select a fragment and encode it, along with the fragment offset so that the correct corresponding fragment is selected from a downstream router for processing. Their next approach is to further take this edge id and fragment it into k smaller fragments. This new data entity is called an edge id and reduces the required state for edge sampling by half. Upon being detected at b (by detecting a 0 in the distance), b XORs its address with the address of a. Node a inserts its IP address into the packet and sends it to b.

The first approach is to XOR each node forming an edge in the path with each other. They suggest three ways to reduce the state information of these approaches into something more manageable. This approach would require more state information in each packet than simple node marking but would converge much faster. The second approach, edge marking, requires that the two nodes that make up an edge mark the path with their IP addresses along with the distance between them. They propose that the router mark the packet with either the router’s IP address or the edges of the path that the packet traversed to reach the router.įor the first alternative, marking packets with the router's IP address, analysis shows that in order to gain the correct attack path with 95% accuracy as many as 294,000 packets are required. suggested probabilistically marking packets as they traverse routers through the Internet.

Ip grabber