Forensics Tracking for IP Spoofers Using Path Backscatter Messages

Attackers may use spoofed IP addresses to conceal their real locations. A number of different mechanisms are suggested to track the spoofers. However, due to the difficulties of implementation, there has been no commonly adopted IP traceback mechanism, at least at the Internet-level. Consequently, the mist on the places of spoofers has never been dissipated until now. This paper suggests a novel passive IP spoofer tracking mechanism that bypasses the implementation difficulties of IP traceback methods. This mechanism uses Internet Control Message Protocol error messages (named path backscatter) triggered by spoofing packets, and traces the spoofers depending on publicly available information (e. g. , topology). In this way, the mechanism can find the spoofers without any further deployment requirements. This work discusses the causes and collection of path backscatter messages. Furthermore, by employing the TTL field in IP packets, the geographical location details of routing device near to IP spoofers are found. Though the proposed scheme cannot work in all the spoofing attacks, it may be the most useful mechanism to trace spoofers before an Internet-level traceback system has been deployed in real.