A comparative study on different probabilistic packet marking schemes for IP traceback

Probabilistic packet marking (PPM) is an IP traceback technique that lets routers probabilistically mark packets with partial information of an attack path during packet forwarding. In this paper, we theoretically evaluate the efficiency of typical PPM schemes, including fragment marking, hash marking, multiple hash, and hash fragment schemes, based on a simple analytical model. In particular, for each scheme, we derive an explicit representation of the average number of packets that the victim should receive until the entire attack paths can be reconstructed. We numerically evaluate the efficiency of each PPM scheme in terms of the false negative ratio of the attack path detection.