In part prompted by the difficulties in determining the true origins of DDOS attacks featuring spoofed IP addresses, researchers have attempted to develop the concept of IP traceback: determining the actual origin of a packet on the Internet, without relying on the IP source field contained in that potentially falsified packet. Early IP traceback techniques relied on logging each packet forwarded by each router.

I know that IP traceback helps trace the real user that send a request by spoofing an IP address. But what information does the router logs?

  • The quote tells you what is recorded: the packet. I'm not sure what you are asking. Can you clarify?
    – schroeder
    Feb 8, 2019 at 13:37

1 Answer 1


There is no singular IP Traceback implementation, although researchers have proposed many solutions in the past.

If you look at the Wikipedia article under the "Router based approach" section, you will find a few proposed methods of fingerprinting a packet.

Here's an article from CISCO that touches on techniques routers can perform to prevent IP spoofing.

I'm not aware of any router that has a turnkey solution that performs IP Traceback outside of your own network though. There isn't a standard protocol to request an IP Traceback.

Not the answer you're looking for? Browse other questions tagged .