Hop-count filtering: an effective defense against spoofed DDoS traffic

ABSTRACT

IP spoofing has been exploited by Distributed Denial of Service (DDoS) attacks to (1) conceal flooding sources and localities in flooding traffic, and (2) coax legitimate hosts into becoming reflectors, redirecting and amplifying flooding traffic. Thus, the ability to filter spoofed IP packets near victims is essential to their own protection as well as to their avoidance of becoming involuntary DoS reflectors. Although an attacker can forge any field in the IP header, he or she cannot falsify the number of hops an IP packet takes to reach its destination. This hop-count information can be inferred from the Time-to-Live (TTL) value in the IP header. Using a mapping between IP addresses and their hop-counts to an Internet server, the server can distinguish spoofed IP packets from legitimate ones. Base on this observation, we present a novel filtering technique that is immediately deployable to weed out spoofed IP packets. Through analysis using network measurement data, we show that Hop-Count Filtering (HCF) can identify close to 90% of spoofed IP packets, and then discard them with little collateral damage. We implement and evaluate HCF in the Linux kernel, demonstrating its benefits using experimental measurements.

REFERENCES

• 1: Dave Andersen. tcptraceroute. Available: http://nms.lcs.mit.edu/software/ron/.
• 2: Razor Team at~Bindview. Despoof, 2000. Available: http://razor.bindview.com/tools/desc/despoof_readme.html.
• 3: Gaurav Banga , Peter Druschel , Jeffrey C. Mogul, Resource containers: a new facility for resource management in server systems, Proceedings of the third symposium on Operating systems design and implementation, p.45-58, February 1999, New Orleans, Louisiana, United States
• 4: S. M. Bellovin. Icmp traceback messages. In Internet Draft: draft-bellovin-itrace-00.txt (work in progress), March 2000.
• 5: N. Bhatti and R. Friedrich. Web server support for tiered services. IEEE Network, 13(5), September/October 1999.
• 6: CERT Advisory CA-2000.01. Denial-of-service development, January 2000. Available: http://www.cert.org/advisories/CA-2000-01.html.
• 7: CERT Advisory CA-96.21. TCP SYN flooding and IP spoofing, November 2000. Available: http://www.cert.org/advisories/CA-96-21.html.
• 8: CERT Advisory CA-98.01. smurf IP denial-of-service attacks, January 1998. Available: http://www.cert.org/advisories/CA-98-01.html.
• 9: B. Cheswick, H. Burch, and S. Branigan. Mapping and visualizing the internet. In Proceedings of USENIX Annual Technical Conference '2000, San Diego, CA, June 2000.
• 10: K. Claffy, T. E. Monk, and D. McRobb. Internet tomography. In Nature, January 1999. Available: http://www.caida.org/Tools/Skitter/.
• 11: E. Cronin, S. Jamin, C. Jin, T. Kurc, D. Raz, and Y. Shavitt. Constrained mirror placement on the internet. IEEE Journal on Selected Areas in Communications, 36(2), September 2002.
• 12: Sven Dietrich , Neil Long , David Dittrich, Analyzing Distributed Denial of Service Tools: The Shaft Case, Proceedings of the 14th USENIX conference on System administration, December 03-08, 2000, New Orleans, Louisiana
• 13: D. Dittrich. Distributed Denial of Service (DDoS) attacks/tools page. Available: http://staff.washington.edu/dittrich/misc/ddos/.
• 14: The~Swiss Education and Research Network. Default TTL values in TCP/IP, 2002. Available: http://secfr.nerim.net/docs/fingerprint/en/ttl_default.html.
• 15: P. Ferguson and D. Senie. Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing. In RFC 2267, January 1998.
• 16: National Laboratory for Applied Network Research. Active measurement project (amp), 1998-. Available: http://watt.nlanr.net/.
• 17: Steve Romig, The OSU Flow-tools Package and CISCO NetFlow Logs, Proceedings of the 14th USENIX conference on System administration, December 03-08, 2000, New Orleans, Louisiana
• 18: Lee Garber, Denial-of-Service Attacks Rip the Internet, Computer, v.33 n.4, p.12-17, April 2000 [doi>10.1109/MC.2000.839316]
• 19: S. Gibson. Distributed reflection denial of service. In Technical Report, Gibson Research Corporation, February 2002. Available: http://grc.com/dos/drdos.htm.
• 20: T. M. Gil and M. Poletter. Multops: a data-structure for bandwidth attack detection. In Proceedings of USENIX Security Symposium'2001, Washington D.C, August 2001.
• 21: R. Govinda and H. Tangmunarunkit. Heuristics for internet map discovery. In Proceedings of IEEE INFOCOM '2000, Tel Aviv, Israel, March 2000.
• 22: Arbor Networks Inc. Peakflow DoS, 2002. Available: http://arbornetworks.com/standard?tid=34&cid=14.
• 23: J. Ioannidis and S. M. Bellovin. Implementing pushback: Router-based defense against ddos attacks. In Proceedings of NDSS'2002, San Diego, CA, February 2002.
• 24: Angelos D. Keromytis , Vishal Misra , Dan Rubenstein, SOS: secure overlay services, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 25: J. Li, J. Mirkovic, M. Wang, P. Reiher, and L. Zhang. Save: Source address validity enforcement protocol. In Proceedings of IEEE INFOCOM '2002, New York City, NY, June 2002.
• 26: Ratul Mahajan , Steven M. Bellovin , Sally Floyd , John Ioannidis , Vern Paxson , Scott Shenker, Controlling high bandwidth aggregates in the network, ACM SIGCOMM Computer Communication Review, v.32 n.3, p.62-73, July 2002 [doi>10.1145/571697.571724]
• 27: D. Moore, G. Voelker, and S. Savage. Inferring internet denial of service activity. In Proceedings of USENIX Security Symposium'2001, Washington D.C., August 2001.
• 28: Robert T. Morris. A weakness in the 4.2bsd unix tcp/ip software. In Computing Science Technical Report 117, AT&T Bell Laboratories, Murray Hill, NJ, February 1985.
• 29: Mazu Networks. Enforcer, 2002. {Online}. Available: http://www.mazunetworks.com/products/.
• 30: Peter G. Neumann , Phillip A. Porras, Experience with EMERALD to Date, Proceedings of the Workshop on Intrusion Detection and Network Monitoring, p.73-80, April 09-12, 1999
• 31: Kihong Park , Heejo Lee, On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.15-26, August 2001, San Diego, California, United States
• 32: Vern Paxson, End-to-end routing behavior in the Internet, IEEE/ACM Transactions on Networking (TON), v.5 n.5, p.601-615, Oct. 1997 [doi>10.1109/90.649563]
• 33: Vern Paxson, An analysis of using reflectors for distributed denial-of-service attacks, ACM SIGCOMM Computer Communication Review, v.31 n.3, July 2001 [doi>10.1145/505659.505664]
• 34: M. Poletto. Practical approaches to dealing with ddos attacks. In NANOG 22 Agenda, May 2001. Available: http://www.nanog.org/mtg-0105/poletto.html.
• 35: Xiaohu Qie , Ruoming Pang , Larry Peterson, Defensive programming: using an annotation toolkit to build DoS-resistant software, Proceedings of the 5th symposium on Operating systems design and implementation

  Due to copyright restrictions we are not able to make the PDFs for this conference available for downloading

  , December 09-11, 2002, Boston, Massachusetts [doi>10.1145/1060289.1060295]
• 36: Stefan Savage , David Wetherall , Anna Karlin , Tom Anderson, Practical network support for IP traceback, Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, p.295-306, August 28-September 01, 2000, Stockholm, Sweden
• 37: Alex C. Snoeren, Hash-based IP traceback, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.3-14, August 2001, San Diego, California, United States
• 38: D. Song and A. Perrig. Advanced and authenticated marking schemes for IP traceback. In Proceedings of IEEE INFOCOM '2001, Anchorage, Alaska, March 2001.
• 39: Oliver Spatscheck , Larry L. Peterson, Defending against denial of service attacks in Scout, Proceedings of the third symposium on Operating systems design and implementation, p.59-72, February 1999, New Orleans, Louisiana, United States
• 40: Neil Spring , Ratul Mahajan , David Wetherall, Measuring ISP topologies with rocketfuel, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 41: R. Stone. Centertrack: An IP overlay network for tracking DoS floods. In Proceedings of USENIX Security Symposium'2000, Denver, CO, August 2000.
• 42: S. Templeton and K. Levitt. Detecting spoofed packets. In Proceedings of The Third DARPA Information Survivability Conference and Exposition (DISCEX III)'2003, Washington, D.C., April 2003.
• 43: H. Wang, D. Zhang, and K. G. Shin. Detecting syn flooding attacks. In Proceedings of IEEE INFOCOM '2002, New York City, NY, June 2002.
• 44: G. R. Wright and W. R. Stevens. TCP/IP Illustrated, Volume 2. Addison-Wesley Publishing Company, 1994.
• 45: Abraham Yaar , Adrian Perrig , Dawn Song, Pi: A Path Identification Mechanism to Defend against DDoS Attacks, Proceedings of the 2003 IEEE Symposium on Security and Privacy, p.93, May 11-14, 2003

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS

General Terms:
Algorithms, Performance, Security

Keywords:
DDoS defense, TTL, host-based, networking, security