关键词: 拒绝服务攻击, IP地址欺骗, IP包摘要, IP包追踪, Unix, 包转发算法, 代理

Abstract: A new technique was presented to trace spoofed packets back to their actual source host without relying on the cooperation of intervening ISPs. An agent-based distributed architecture for tracing suspicious IP packets was outlined. An agent server was designed to record packet digests, and a security control server was designed to traceback the originator of a spoofing IP packet. The arithmetic forwarding IP packet in Unix OS was expanded. The packet digest arithmetic and the agent-based automatic tracing system were realized. The methods for identifying suspicious packets and recording packet digest were tested through the simulation experiments. The agent-based method of tracing IP packet is feasible.