Paper review:  Hash-Based IP Traceback  

Reviewer: Kevin Hofstra

  1. How can we efficiently and reliably identify the originator of an IP packet?  What kind of implementation latency and storage requirements are we willing to sacrifice?  Can this be done locally or must the responsibility be distributed?
  2. A proposal for Hash-based IP traceback.  Hash based makes the lookup very quick, and greatly reduces the storage requirements.


A.         A traceback system should meet some certain conditions:

i.                     Packets can be addressed to any number of hosts.

ii.                   Packet size must not be increased.

iii.                  Traces are infrequent.

iv.                 End hosts do not need to have all the resources.

B.                 The ultimate goal is to find the originator of the packet.  In certain cases it is only reasonable to trace the packet back to the last misbehaving link.  Transformations that are performed due to valid processing can be mapped back to its originator, but transformation due to router error or malicious intent can only be traced back to the closest occurrences.

C.                 SPIE (Source Path Isolation Engine) can be considered a breakthrough.  Instead of keeping the entire packet which leads to storage and privacy problems, the routers audit the source addresses only.  This decreases the packet storage from very large packets to a 32-bit packet digest.  This also alleviates the problem of privacy since the packet information is not stored.

D.                 Bloom filters keep track of the packet digests.  It computes k distinct digests using a hashing function and uses the n bit results to index to a 2^n sized array.

  1. Critique the main contribution
  2. System researchers and builders should recognize that although per packet accountability on the internet would lead to increased stability, it is dependant on everyone agreeing on its importance and helping each other to implement it.  Older routes may not have neither the processing capability nor the incentive to audit every packet.  In a system such as this, the traceback is only as good as its weakest link, which in the case of the internet may be completely unresponsive.  The problem of creating an environment with accountability when it was never intended may turn out to be unfeasible until every member of the network agrees on its importance.