William Timothy Strayer

Hardware support for a hash-based IP traceback

The Source Path Isolation Engine (SPIE) is a system capable of tracing a single IP packet to its point of origin or point of ingress into a network. SPIE supports tracing by scoring a few bits of unique information about each packet for a period of time as the packets traverse the network. Software implementations of SPIE can trace packets through networks comprised of slow-to-medium speed routers (up to OC-12), but higher-speed routers (OC-48 and faster) require hardware support. In this paper, we discuss these hardware design aspects of SPIE. Most of the hardware resides in a self-contained SPIE processing unit, which may be implemented in a line card form factor for insertion into the router itself or as a stand-alone unit that connects to the router through an external interface.

FIRE: flexible intra-AS routing environment

Current routing protocols are monolithic, specifying the algorithm used to construct forwarding tables, the metric used by the algorithm (generally some form of hop count), and the protocol used to distribute these metrics as an integrated package. The flexible intra-AS routing environment (FIRE) is a link-state, intradomain routing protocol that decouples these components. FIRE supports run-time-programmable algorithms and metrics over a secure link-state distribution protocol. By allowing the network operator to dynamically reprogram both the properties being advertised and the routing algorithms used to construct forwarding tables, FIRE enables the development and deployment of novel routing algorithms without the need for a new protocol to distribute state. FIRE supports multiple concurrent routing algorithms and metrics, each constructing separate forwarding tables. By using operator-specified packet filters, separate classes of traffic may be routed using completely different routing algorithms, all supported by a single routing protocol. This paper presents an overview of FIRE, focusing particularly on FIREs novel aspects with respect to traditional routing protocols. We consider deploying several current unicast and multicast routing algorithms in FIRE, and describe our Java-based implementation.

Traceback of single IP packets using SPIE

The design of the Internet protocol makes it difficult to reliably identify the originator of an IP packet. IP traceback techniques have been developed to determine the source of large packet flows, but, to date, no system has been presented to track individual packets in an efficient, scalable fashion. We present SPIE, the Source Path Isolation Engine, a hash-based technique for IP traceback that generates audit trails for traffic within the network, and can trace the origin of a single IP packet delivered by the network in the recent past.

SPIE demonstration: single packet traceback

SPIE, the Source Path Isolation Engine, is a DARPA-funded system for tracing single IP packets back through a network of instrumented routers or tap boxes that are associated with the routers. Historically, tracing individual packets by keeping packet logs at each router has required prohibitive amounts of memory; one of SPIEs key innovations is to reduce the memory requirement (down to 0.5% of link capacity) by storing only packet digests, that is, hashes of the packets rather than the packet itself. SPIE-enhanced routers maintain a cache of packet digests for recently forwarded traffic. If a packet is determined to be offensive by an intrusion detection system (or judged interesting by some other metric), a query is dispatched to the SPIE system that, in turn, queries routers for packet digests of the relevant time periods. ne results of this query are used in a simulated reverse-path flooding algorithm to build a highly reliable and accurate attack graph that identifies the packets source or sources.