What IP Traceback technique's basic idea is to have routers label a subset of transit packets with information about the router labeling router, thus enabling the receiver to reconstruct the path…

Question

Options

• ASPIE
• BITRACE
• CPPM
• DIngress Filtering

• A
  10% (3)
• B
  6% (2)
• C
  81% (25)
• D
  3% (1)

Explanation

Probabilistic Packet Marking (PPM) is correct because it precisely matches the description: routers stochastically "mark" a small fraction of forwarded packets with their own identity (IP address or edge fragment), so a victim receiving enough marked packets can statistically reconstruct the full attack path back to the source without any additional infrastructure.

SPIE is wrong - it uses hash-based audit trails stored at each router to record digests of passing packets, requiring active querying of routers after an attack rather than in-band packet labeling.

ITRACE is wrong - routers do generate router-identity information, but they send it as separate out-of-band ICMP traceback messages, not by labeling the transit packets themselves.

Ingress Filtering is wrong entirely - it is a prevention mechanism (BCP 38) that drops packets with spoofed source IPs at network borders; it performs no path reconstruction at all.

Memory tip: Think of PPM as "routers leave breadcrumbs on the packets" - probabilistic, passive, and in-band. If the technique sends a separate message or queries router logs, it's not PPM.

No community discussion yet for this question.