Single-Packet IP Traceback Alex C. Snoeren BBN Technologies (with Craig Partridge, Tim Strayer, Christine Jones, Fabrice Tchakountio, Beverly Schwartz, Matthew Condell, Bob Clements, and Steve Kent) Motivation – Way too long. Hari – Related work? Higher-level. Frans – Focus problem. Define Traceback – What do you do with the system?

SPIE in Action

Challenges to Logging Attack path reconstruction is difficult Packet may be transformed as it moves through the network Full packet storage is problematic Memory requirements are prohibitive at high line speeds (OC-192 is ~10Mpkt/sec) Extensive packet logs are a privacy risk Traffic repositories may aid eavesdroppers Path construction

Packet Digesting Record only invariant packet content Mask dynamic fields (TTL, checksum, etc.) Store information required to invert packet transformations at performing router Compute packet digests instead Use hash function to compute small digest Store probabilistically in Bloom filters Impossible to retrieve stored packets

Invariant Content Ver HLen TOS Total Length Identification M F Fragment Offset TTL Protocol Checksum 28 bytes Source Address Destination Address Options First 8 bytes of Payload Remainder of Payload

Bloom Filters Fixed structure size Insertion is easy Variable capacity Uses M bit array Initialized to zeros Insertion is easy Use ℓ-bit digest as indices into bit array ℓ bits 1 H2(P) Hk(P) H3(P) H1(P) 1 . . . Mitigate collisions by using k digests H(P) M bits Variable capacity Easy to adjust Store up to n packets

Limited Error Propagation Bloom filters may be mistaken Mistake frequency can be controlled Depends on capacity of full filters Neighboring routers won’t be fooled Vary hash functions used in Bloom filters Each router select hashes independently Long chains of mistakes highly unlikely Probability drops exponentially with length

False Positive Distribution

Adjusting Graph Accuracy False positives rate depends on: Length of the attack path, N Complexity of network topology, d Capacity of Bloom filters, P Bloom filter capacity is easy to adjust Required filter capacity varies with router speed and number of neighbors Appropriate capacity settings achieve linear error growth with path length

Simulation Results N/7 Nρ/(1-ρ) → ρ = 1/8 P = ρ Random Graph Real ISP, 100% Utilization Real ISP, Actual Utilization 0.8 0.8 0.8 0.8 Degree-Independent N/7 Nρ/(1-ρ) → ρ = 1/8 What are the actual numbers? 0.6 0.6 0.6 0.6 P = ρ Expected Number of False Positives 0.4 0.4 0.4 0.4 May be able to assume degree independence 0.2 0.2 0.2 0.2 P = ρ/d 5 5 5 5 10 10 10 10 15 15 15 15 20 20 20 20 25 25 25 25 30 30 30 30 Length of Attack Path (N)

How Big are Digests? Quick rule of thumb: ρ = 1/8, assuming degree independence Bloom filter k = 3, M/n = 5 bits per packet. Assume packets are ~1000 bits Filters require ~0.5% of link capacity Four OC-3s require 47MB per minute 128 OC-192 links need <100GB per minute Access times are equally important Current drives can write >3GB per minute OC-192 needs SRAM access times 4 OC-3 Hd needs 67GB/day

Filter Paging “Small” Bloom filters Store multiple filters Random access Need fast memory Store multiple filters Increase time span Ring buffer avoids memory copies Timestamp each bin Fence-post issues B G E C D F H A

Transformations Occasionally invariant content changes Network Address Translation (NAT) IP/IPsec Encapsulation, etc. IP Fragmentation ICMP errors/requests Routers need to invert these transforms Often requires additional information Can store this information at the router

Transform Lookup Table Only need to restore invariant content Often available from the transform (e.g., ICMP) Otherwise, save data at transforming router Index required data by transformed packet digest Record transform type and sufficient data to invert Bounded by transform performance of router Digest Packet Data C Type 28 bits 4 bits 32 bits

Prototype Implementation Implemented in PC-based routers Both FreeBSD and Linux implementations Packet digesting on kernel forwarding path Zero-copy kernel/user digest tables Digest tables and TLT stored in kernel space User-level query-support daemons Supports automatic topology discovery Queries automatically triggered by IDS

SPIEDER Approach SPIE DGA Encompassing Router (SPIEDER) external Each router has an internal Data Generation Agent (DGA) external DGA Router SPIE DGA Encompassing Router (SPIEDER)

Summary Hash-based traceback is viable With reasonable memory constraints Supports common packet transforms Timely tracing of individual packets Publicly available implementations FreeBSD/Linux versions available now SPIEDER-based solution in development http://www.ir.bbn.com/projects/SPIE