IPv6 Packet Traceback: A Survey Rajesh Kumar Singh
---
paper_title: IP traceback: a new denial-of-service deterrent?

paper_content:

The increasing frequency of malicious computer attacks on government agencies and Internet businesses has caused severe economic waste and unique social threats. IP traceback-the ability to trace IP packets to their origins-is a significant step toward identifying, and thus stopping, attackers.
---
paper_title: On IP Traceback

paper_content:

In this article we present the current state of the art in IP traceback. The rising threat of cyber attacks, especially DDoS, makes the IP traceback problem very relevant to today's Internet security. Each approach is evaluated in terms of its pros and cons. We also relate each approach to practical deployment issues on the existing Internet infrastructure. The functionality of each approach is discussed in detail and then evaluated. We conclude with a discussion on some legal implications of IP traceback.
---
paper_title: Tracing cyber attacks from the practical perspective

paper_content:

The integrity of the Internet is severely impaired by rampant denial of service and distributed DoS attacks. It is by no means trivial to devise a countermeasure to address these attacks because of their anonymous and distributed nature. This article presents a brief survey of the most promising recently proposed schemes for tracing cyber attacks: IP traceback. Since IP traceback technology is evolving rapidly, for the community to better comprehend and capture the properties of disparate traceback approaches, we first classify these schemes from multiple aspects. From the perspective of practicality and feasibility, we then analyze and explore the advantages and disadvantages of these schemes in depth so that shortcomings and possible enhancements of each scheme are highlighted. Finally, open problems and future work are discussed, and concluding remarks are drawn.
---
paper_title: IP traceback: a new denial-of-service deterrent?

paper_content:

The increasing frequency of malicious computer attacks on government agencies and Internet businesses has caused severe economic waste and unique social threats. IP traceback-the ability to trace IP packets to their origins-is a significant step toward identifying, and thus stopping, attackers.
---
paper_title: On IP Traceback

paper_content:

In this article we present the current state of the art in IP traceback. The rising threat of cyber attacks, especially DDoS, makes the IP traceback problem very relevant to today's Internet security. Each approach is evaluated in terms of its pros and cons. We also relate each approach to practical deployment issues on the existing Internet infrastructure. The functionality of each approach is discussed in detail and then evaluated. We conclude with a discussion on some legal implications of IP traceback.
---
paper_title: Tracing cyber attacks from the practical perspective

paper_content:

The integrity of the Internet is severely impaired by rampant denial of service and distributed DoS attacks. It is by no means trivial to devise a countermeasure to address these attacks because of their anonymous and distributed nature. This article presents a brief survey of the most promising recently proposed schemes for tracing cyber attacks: IP traceback. Since IP traceback technology is evolving rapidly, for the community to better comprehend and capture the properties of disparate traceback approaches, we first classify these schemes from multiple aspects. From the perspective of practicality and feasibility, we then analyze and explore the advantages and disadvantages of these schemes in depth so that shortcomings and possible enhancements of each scheme are highlighted. Finally, open problems and future work are discussed, and concluding remarks are drawn.
---
paper_title: An examination of IPv4 and IPv6 networks : Constraints and various transition mechanisms

paper_content:

The concept of transiting from IPv4 network to IPv6 network is being processed vigorously. Extensive study is being done presently on this subject as transition from IPv4 to IPv6 requires a high level compatibility and clear procedure for easy and independent deployment of IPv6. The transition between IPv4 internet and IPv6 will be a long process as they are two completely separate protocols. IPv6 is not backward compatible with IPv4, and IPv4 hosts and routers will not be able to deal directly with IPv6 traffic and vice-versa. In fact that there will be extreme difficulties with address allocation and routing if the internet is to continue to run indefinitely using IPv4. Also it is impossible to switch the entire internet over to IPv6 over night. As IPv4 and IPv6 will co-exist for a long time, this requires the transition and inter-operation mechanism. Due to this reason several transitions mechanisms have been developed that can be used to make the transition to IPv6 smoothly. Most applications today support IPv4 and thus there is a need to run these applications on IPv6 access network, especially to persons who are generally on mobile and they want to securely connect to their home network so as to reach IPv4 services. This paper discusses constraints, various techniques and standards require for high level compatibility smooth transition and interoperation between IPv4 and IPv6 by removing the constraints.
---
paper_title: A secure packet marking scheme for IP traceback in IPv6

paper_content:

The growing threat of cyber attacks, especially the DDoS (Distributed Denial of Service Attack) makes the IP Traceback very much prevalent to today's Internet security. IP Traceback is one of the security concerns that is associated with finding out the true origin of the attack/attacker. This process is very cumbersome as the IP addresses in most cases are spoofed addresses. The techniques that are used at present were designed for IPv4. Although IPv6 overcomes some of the security risks that could not be addressed at the protocol level, some problems are yet to be addressed. In addition to this, the prevailing traceback schemes need to be modified prior to their use in IPv6. Our approach in this paper focuses on a secure packet marking mechanism that would help in obtaining the marking which are authentic which a desired criteria for an improved marking scheme.
---
paper_title: Modified Deterministic Packet Marking for DDoS Attack Traceback in IPv6 Network

paper_content:

Although possible security threats were taken into consideration when IPv6 was formulated, attacks, especially distributed denial-of-service (DDoS), still exist in IPv6 network. This makes IP trace back schemes very relevant to the security of IPv6 network. As many current IP trace back schemes are designed according to IPv4, they can not be directly used in IPv6 network. A modified Deterministic Packet Marking (DPM) for DDoS attack trace back in IPv6 network is presented in this work. This method is able to trace a huge number of simultaneous DDoS attackers. As the trace back process can be performed post-mortem, it can also trace the attacks that have not been noticed at first. Besides, it only takes a small amount of marked packets to complete the trace back process. It is also simple to implement and consumes practically no additional processing overhead on the network equipments. Although the initial motivation of modified DPM is to trace DDoS attack, it can also be used to filter anomaly traffic in IPv6 network.
---
paper_title: A novel IPv6 traceback architecture using COPS protocol

paper_content:

In any Distributed Denial of Service (DDoS) attack, invaders may use incorrect or spoofed Internet Protocol (IP) addresses in the attacking packets and thus disguise the actual origin of the attacks. This is primarily due to the stateless nature of the Internet. IP traceback algorithms provide mechanisms for identifying the true source of an IP datagram on the Internet ensuring at least the accountability of cyber attacks. While many IP traceback techniques have been proposed, most of the previous studies focus and offer solutions for DDoS attacks done on Internet Protocol version 4 (IPv4) environment. IPv4 and IPv6 networks differ greatly from each other, which urge the need of traceback techniques specifically tailored for IPv6 networks. In this paper, we propose a novel traceback architecture for IPv6 networks using Common Open-Policy Service and a novel packet-marking scheme. We also provide complete underlying protocol details required for traceback support in IPv6 networks. The proposed architecture is on demand and only single packet is required to traceback the attack.
---
paper_title: A Link Signature Based DDoS Attacker Tracing Algorithm under IPv6

paper_content:

The ipv6 security architecture, IPSec, plays a positive role in the protection of IPv6 networks. To some special attacks, especially DDoS attacks, IPSec appears relatively weak, because IPSec can only defend against DDoS attacks that spoof their source addresses. In cases where attackers launch DDoS attacks with their real identity, IPSec is helpless. This paper proposes a link signature based DDoS attacker tracing algorithm. It can immediately reconstruct the entire attack path after suffering a DDoS attack whether or not the source addresses are spoofed. To verify the validity of our algorithm, we implemented it under a simulated IPv6 environment with the OMNeT++ IPv6Suite.
---
paper_title: IPv6 Traceback Using Policy Based Management System

paper_content:

Most of the cyber attacks use spoofed IP packets to cast an attack. The stateless nature of IP makes it nearly impossible to identify the true source(s) of these attacks. With the help of IP traceback techniques, we try to identifying the true source of an IP datagram in Internet. While many IP traceback techniques have been proposed, but most of the previous studies focus and offer solutions for DDoS attacks done on IPv4 environment. IPv4 and IPv6 Networks differ greatly from each other, for instance, absence of the Option field in basic IPv6 header. Thus, the mechanisms of IP Traceback for IPv4 networks may not apply to IPv6 networks. In this paper, we extend our previous work i.e. PPM for IPv6 and remove its drawback by using Policy Based IP Traceback (PBIT) mechanism. We also discuss problems related to previously proposed IPv4 traceback schemes and practical subtleties in implementing traceback techniques for IPv6 networks. *
---
paper_title: SPIE-IPv6: single IPv6 packet traceback

paper_content:

The source path isolation engine (SPIE), developed at BBN, provides accurate tracing of single IP packets through a network. The SPIE system calculates several small hash values for each packet as it traverses a router, then stores these values in a data structure called a Bloom filter. Given a packet and an approximate time that packet was in the network, the SPIE system queries routers along the potential reverse path; a packet was "seen" at a router if the Bloom filter has stored the packet's hash values. The SPIE system has been proven to work effectively and efficiently for IP version 4, largely because an IPv4 packet has sufficient entropy in the first 28 bytes to allow the hash functions to "uniquely" identify each packet. We extend the traceback architecture to IP version 6, with the interesting result that the packet structure of IPv6 does not provide as much entropy in the field values as IPv4.
---
paper_title: Authenticated IPv6 packet traceback against reflector based packet flooding attack

paper_content:

IPv6 can provide end-to-end security services such as access control, confidentiality, and data integrity with less impact on network performance. However, we can also prospect that there will be much more dangerous and tremendous type of attack on IPv6 than that on IPv4. So, we propose new IP traceback mechanism for tracing the spoofed real source on IPv6 packet using authentication mechanism. Proposed authentication mechanism supports the key disclosure mechanism on IPv6 packet marking with ICMPv6 on the IP traceback process.
---
paper_title: A lightweight IP traceback mechanism on IPv6

paper_content:

Due to the stateless nature of the internet, it is an intricate problem to determine the source of spoofed attacking packets. To handle this problem we utilize the IP traceback mechanism to know the actual source of an IP datagram. While many IP traceback techniques have been proposed but most of the previous studies focus and offer solutions for DDoS attacks done on IPv4 environment. Significant difference exists between IPv4 and IPv6 Networks. Therefore, the mechanisms for tracing the origin of attacks in IPv6 networks have abundant differences from those of IPv4 networks. In this paper, we proposed an efficient Lightweight IPv6 traceback algorithm. We also discussed the problems related to previously proposed IPv4 traceback schemes and presented the Error Correction and Modified Path MTU calculation algorithm to make our scheme more practical.
---
paper_title: A secure packet marking scheme for IP traceback in IPv6

paper_content:

The growing threat of cyber attacks, especially the DDoS (Distributed Denial of Service Attack) makes the IP Traceback very much prevalent to today's Internet security. IP Traceback is one of the security concerns that is associated with finding out the true origin of the attack/attacker. This process is very cumbersome as the IP addresses in most cases are spoofed addresses. The techniques that are used at present were designed for IPv4. Although IPv6 overcomes some of the security risks that could not be addressed at the protocol level, some problems are yet to be addressed. In addition to this, the prevailing traceback schemes need to be modified prior to their use in IPv6. Our approach in this paper focuses on a secure packet marking mechanism that would help in obtaining the marking which are authentic which a desired criteria for an improved marking scheme.
---
paper_title: Modified Deterministic Packet Marking for DDoS Attack Traceback in IPv6 Network

paper_content:

Although possible security threats were taken into consideration when IPv6 was formulated, attacks, especially distributed denial-of-service (DDoS), still exist in IPv6 network. This makes IP trace back schemes very relevant to the security of IPv6 network. As many current IP trace back schemes are designed according to IPv4, they can not be directly used in IPv6 network. A modified Deterministic Packet Marking (DPM) for DDoS attack trace back in IPv6 network is presented in this work. This method is able to trace a huge number of simultaneous DDoS attackers. As the trace back process can be performed post-mortem, it can also trace the attacks that have not been noticed at first. Besides, it only takes a small amount of marked packets to complete the trace back process. It is also simple to implement and consumes practically no additional processing overhead on the network equipments. Although the initial motivation of modified DPM is to trace DDoS attack, it can also be used to filter anomaly traffic in IPv6 network.
---
paper_title: A novel IPv6 traceback architecture using COPS protocol

paper_content:

In any Distributed Denial of Service (DDoS) attack, invaders may use incorrect or spoofed Internet Protocol (IP) addresses in the attacking packets and thus disguise the actual origin of the attacks. This is primarily due to the stateless nature of the Internet. IP traceback algorithms provide mechanisms for identifying the true source of an IP datagram on the Internet ensuring at least the accountability of cyber attacks. While many IP traceback techniques have been proposed, most of the previous studies focus and offer solutions for DDoS attacks done on Internet Protocol version 4 (IPv4) environment. IPv4 and IPv6 networks differ greatly from each other, which urge the need of traceback techniques specifically tailored for IPv6 networks. In this paper, we propose a novel traceback architecture for IPv6 networks using Common Open-Policy Service and a novel packet-marking scheme. We also provide complete underlying protocol details required for traceback support in IPv6 networks. The proposed architecture is on demand and only single packet is required to traceback the attack.
---

```
Title: IPv6 Packet Traceback: A Survey

Section 1: INTRODUCTION
Description 1: Write an introduction to the topic of IPv6 packet traceback, providing an overview of internet growth, IPv4 limitations, IPv6 adoption, and the significance of IP traceback techniques.

Section 2: IPV4 TECHNIQUES AND METRICS
Description 2: Detail the existing IP traceback methods used in IPv4 networks, including link testing, logging, ICMP traceback, and packet marking, along with the metrics for evaluating these techniques.

Section 3: COMPARING IPV4 AND IPV6
Description 3: Compare the differences between IPv4 and IPv6 protocols, highlighting the necessity for new traceback techniques tailored to IPv6 due to differences in packet formats and network requirements.

Section 4: SURVEY OF IPV6 TRACEBACK TECHNIQUES
Description 4: Provide a comprehensive survey of various IPv6 traceback methods, including SPIE, authenticated IP traceback, deterministic packet marking, policy-based management systems, and other proposed algorithms.

Section 5: CHALLENGES
Description 5: Discuss the major challenges associated with IPv6 traceback techniques, such as mark spoofing, dual stack implementations, and gradual deployment in the transition from IPv4 to IPv6.

Section 6: CONCLUSION AND FUTURE WORK
Description 6: Summarize the findings of the survey, emphasize the importance of developing effective IPv6 traceback methods, and suggest future research directions to address current limitations.
```