Backscatter DDoS Trace Back

Last Updated on Wed, 28 Jun 2023 | Network Security

This technique was developed by Chris Morrow and Brian Gemberling at UUNET, and it allows a DDoS attack to be stopped and trace back to occur in approximately 10 minutes. The following site provides more information: http://www.secsup.org/Tracking/.

At a high level, the mitigation technique works by combining aspects of the sinkhole and black hole routing discussed previously. When a system is under attack, the black hole routing technique allows IS edge routers to route the traffic to null0. This causes an ICMP unreachable to be generated by the route for each spoofed source address that is routed to null. Here's where the trick comes in.

The IPv4 address space is only partially allocated; currently no one owns large blocks of addresses. The list can be found here: http://www.iana.org/assignments/ipv4-address-space. Your ISP can advertise these prefixes and set them to not be exportable to other ISPs. ISPs do this by using the sinkhole route Because these large blocks of IPv4 address space are now routable within the ISP, all of the ICMP unreachables from spoofed sources in the range the ISP is falsely advertising flow to the sinkhole router The sinkhole router sees these ICMP unreachables with a source IP address of the router that sent them Then the ISP has a list of the routers that are seeing the flood attack!

I continue to be amazed by this technique of backscatter trace back. I am constantly surprised by the ingenuity of the Internet's users, and I enjoy it even more when the novel idea is for the cause of good rather than evil. As a note, attackers wishing to get around this method of trace back need only ensure that the spoofed source addresses they use are allocated to legitimate networks.

All of the techniques described in the preceding two subsections are detailed in a North American Netwo Operators Group (NANOG) presentation from NANOG23 titled "ISP SecurityReal World Techniques," delivered by Barry Greene, Chris Morrow, and Brian Gemberling. It is available at the following URL: http://www.nanog.org/mtg-0110/greene.html.

Continue reading here: Figure 623 CAR

Was this article helpful?

+1 -1

Related Posts

Readers' Questions

  • Sarah
    Can a ddos attack be traced?
    7 months ago
    • Yes, a DDoS attack can be traced by analyzing the traffic patterns, packet logs, and other data from the attack. Tracing a DDoS attack requires an in-depth analysis of the origin of the attack and the route taken by the malicious traffic. Additionally, a data forensics team may be able to trace the attack if they have enough information and resources.