To perform a successful traceback, the two most prominent problems that need to be solved are locating the source of IP packets and:

Question

Options

• Athe timestamp of the event
• Bdetermining the first node of a connection chain
• Cthe reflector host
• Dthe victim port

• A
  3% (1)
• B
  73% (22)
• C
  17% (5)
• D
  7% (2)

Explanation

Why B is correct: IP traceback aims to identify the true origin of an attack despite spoofed or forged packet headers. The two core challenges are (1) locating the source of IP packets and (2) determining the first node (entry point) of a connection chain - because attackers often route through multiple intermediaries, and identifying where the chain begins is essential to attributing the attack.

Why the distractors are wrong:

• A (timestamp): Timestamps help with forensic correlation but are not a fundamental traceback problem - they're a logging/analysis concern.
• C (reflector host): Reflectors are relevant to amplification/reflection DDoS attacks specifically, not a general challenge in all traceback scenarios.
• D (victim port): The victim port is already known (it's on the receiving end); traceback is concerned with finding the source, not characterizing the destination.

Memory tip: Think of traceback as answering "where did this come from, and where did the trail start?" - source location + first-node identification. Both questions point backward toward the attacker, which is the entire goal of traceback.

No community discussion yet for this question.