In part prompted by the difficulties in determining the true origins of DDOS attacks featuring spoofed IP addresses, researchers have attempted to develop the concept of IP traceback: determining the actual origin of a packet on the Internet, without relying on the IP source field contained in that potentially falsified packet. Early IP traceback techniques relied on logging each packet forwarded by each router.

I know that IP traceback helps trace the real user that send a request by spoofing an IP address. But what information does the router logs?

closed as unclear what you're asking by schroeder Feb 8 at 13:38

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • The quote tells you what is recorded: the packet. I'm not sure what you are asking. Can you clarify? – schroeder Feb 8 at 13:37

There is no singular IP Traceback implementation, although researchers have proposed many solutions in the past.

If you look at the Wikipedia article under the "Router based approach" section, you will find a few proposed methods of fingerprinting a packet.

Here's an article from CISCO that touches on techniques routers can perform to prevent IP spoofing.

I'm not aware of any router that has a turnkey solution that performs IP Traceback outside of your own network though. There isn't a standard protocol to request an IP Traceback.

Not the answer you're looking for? Browse other questions tagged or ask your own question.